Onboard PBAC Applications

Name

Name of the application

Enter the name of the application, without spaces or special characters.

Display Name

User friendly name of the application

Enter a display name for the application.

Description

Brief characterization of the application

Enter a description.

Select a Location

EmpowerID location to be used for RBAC access to the application.

Select an EmpowerID location for the application.

Select Account Store

Inventoried account store (directory) with application resources. In most cases, EmpowerID should be selected.

Select the inventoried account store (directory) with the resources the application applies to.

PBAC App

Specifies whether the application is a PBAC app. When selected, EmpowerID creates a Resource Module for the application.

Select this option to specify that the app is a PBAC app.

App Authorization Model

Defines the framework within the application for managing user access to its data, specifying how permissions are structured and enforced.

Select the appropriate app authorization model. For example, if the app does not have any app resources stored in the EmpowerID Identity Warehouse for access control, but does have field types, you would select “PBAC App: No App Resources, Yes Field Types.”

Allow Shop for Role Definitions

Specifies whether users can shop for any role definitions created for the application.

Enable/disable the setting for your situation.

Allow Shop for Rights

Specifes whether users can shop for any rights created for the application.

Enable/disable the setting for your situation.

Allow Shop for App Management Roles

Specifies whether users can shop for any Management Roles created for the applications.

Enable/disable the setting for your situation.

Responsible Party

Identifies the primary individual accountable for the application.

Type in the full name of the person who will take responsibility for managing the application. This field is mandatory.

Owners

Lists the people who have ownership rights over the application.

Enter the names of the individuals designated as owners, one at a time. Providing owner information is optional but recommended for better governance.

Deputies

Specifies secondary contacts or assistants to the owners.

Input the names of individuals assigned as deputies, one at a time. Including deputy information is optional.

Set Requestable Setting

Specifies if users can request access to the application in the IAM Shop.

Enable the "Set Requestable Setting" to make the application available to eligible users in the IAM Shop; otherwise, disable the setting.

Select Access Request Policy

Defines the policy to be used for processing application requests.

From the "Select Access Request Policy" dropdown, choose the policy that best fits how you wish to handle incoming requests for the application. For applications, the Default policy is suggested. This policy routes access requests to application owners for approval.

Eligible to Request

Specifies users allowed to request access to the application.

Select the assignee type (e.g., Person, Group, Management Role) and then identify the individuals, groups, or roles eligible to make requests.

Pre-approved for Access

Specifies users who are pre-approved for access to the application, bypassing the need for manual request approval.

Select the assignee type (e.g., Person, Group, Management Role) and then identify the individuals, groups, or roles pre-approved for the application.

Suggested Assignees

Identifies users who will see the application as a suggested resource that they can request.

Select the assignee type (e.g., Person, Group, Management Role) and then identify the individuals, groups, or roles suggested for application access.