Managing Partner Delegations

If your organization has partners that access your system to manage the IT resources you have allocated to them, you can quickly set up your environment to manage those partners using the built-in partner roles and locations.

This topic demonstrates how to manage partner delegations by creating a fictitious partner named "Hendriks Hardware." We then create a test partner admin and a test partner user and log in to EmpowerID as those users. The purpose of this is to test the delegations. You can follow along, creating these test partners or supplying your own.

If the environment has been correctly configured, the partner admins should only be able to see their locations; they should not be able to see your IT infrastructure or those of any other of your partners. The partner admins should also be able to manage their partner users outside of your intervention.

Step 1 – Create a partner location

1. On the navbar, expand Role Management and click Business Roles and Locations.

2. Select the Actions tab and then click Create Location.
   
   

   Open

   

   
   This opens the Location Details form.
   
   

   Open

   

    

3. Do the following in the form:

   1. Name – Name of the partner location. It is recommended the name matches the partner organization.

   2. Display Name – Name of the partner location users to see in the EmpowerID UI.

   3. Description – Short characterization of the location

   4. Tick Is Assignable so that the option is enabled.

   5. Underneath Parent ID, click the X to delete the EmpowerID System location and then click the Select a Location link to open the Location Selector.
      
      

   6. Search for and select Partners.
      
      

       

   7. Select Organization - Security Container as the Location Type.
      
      

       

   8. Leave the other fields as is and click Save to create the Location.

4. Repeat the above steps to create locations for each of your remaining partners.

Step 2 – Create a test partner admin

1. On the navbar, expand Identity Administration and click People.

2. Click the Onboard Person action to initiate the Onboard Person workflow.

3. Select Simple Mode as the Person Creation Mode and click Next to proceed to the Person Details step fo the workflow.
   
   

    

4. Enter a First Name and Last Name for the partner admin.

5. Enter Email and Personal Email addresses for the partner admin.

6. Underneath Primary Business Role and Location, click the Select a Role and Location link to open the Business Role and Location (BRL) Selector.

   1. From the Business Role pane of the BRL Selector, search for and select Partner Admin.
      
      

       

   2. Click Location to show the Location pane of the BRL Selector.

   3. From the Location pane, search for and select one of the partner locations you created above, and then click Select.
      
      

       

7. Click Next to proceed to the Additional Information section of the workflow.

8. Review the summary information and click Submit.
   
   

    

9. Repeat the above steps to create additional test partner admins as needed.

10. Reset the passwords for each of your test partner admins. For information on resetting passwords, see .

Step 3 – Create a test partner user

1. On the navbar, expand Identity Administration and click People.

2. Click the Create Identity action.
   This opens the Create Identity form.
   
   

    

3. Fill in the following required fields and click Save.

4. Repeat the above steps to create additional test partner users as needed.

5. Reset the passwords for each of your test partner users. For information on resetting passwords, see Reset Passwords.

Step 3 – Test the partner delegations

1. Log out of the EmpowerID Web application and log back in as a partner user.

2. If prompted to protect access to your identity, select None.
   
   

    

3. Click the Global Search drop-down at the top of the page. You should only see search options for People.

4. Search for people by clicking in the Global Search field and pressing ENTER. You should only see the people in the partner organization.

5. View the navbar. You should see the navigation items:

Step 3 – Test the partner admin delegations

1. Log out of the EmpowerID Web application and log back in as a partner admin.

2. If prompted to protect access to your identity, select None.
   
   

    

3. You should see the same navigation and search options as the partner user, with the exception that you can access the Find People page from the navbar.

4. From the navbar, expand Identity Administration and click People.
   You should see that you have access to the actions shown below.
   
   

    

Optional exercises

Repeat the above steps, creating as many partner users and partner admins as desired. Your test results should be consistent across the board.

In a non-production environment, do the following to have EmpowerID automatically provision user accounts for the partners:

1. As an administrator, create test OUs for the partner locations you created above.
   For a general example of creating OUs, see Create Organizational Units.

2. Map those locations to the appropriate OUs.
   For a general example of mapping locations to OUs, see Role and Location Mapper.

3. Create a Provisioning Policy that provisions an Active Directory user account in the appropriate OU for each person assigned to the Partner in Partners Business Role and Location. This policy will provision an AD Account for all partner and partner admins in any location under the Partners location.
   For a general example, see Active Directory User Account Provisioning Policies.

4. Log in to the Web application as one of the partner admins and search for user accounts. You should see one user account for each partner you created.