Onboarding PBAC Applications
- Phillip Hanegan
EmpowerID simplifies the integration of PBAC and other types of non-Azure applications through its "Onboard Application" workflow. This wizard-driven process streamlines application onboarding by offering configurable parameters and approval settings, ensuring a tailored fit for your organization's specific needs and security policies.
Procedure
Step 1: Configure workflow parameters
The "Onboard Application" workflow features a variety of customizable parameters that allow administrators to adjust the fields displayed during the onboarding process. These settings enable you to define specific workflow steps' visibility and default values, ensuring the workflow aligns with your organizational requirements.
Configuring Parameters
Sign in to EmpowerID as an administrator and browse to Low Code/No Code Workflow > Low Code Workflows.
Select the Workflow tab and search for Onboard Application.
Click the Display Name link to browse to the workflow’s View One page.
Expand the Request Workflow Parameters accordion on the View One page for the workflow and search for the parameter you need to configure. In this example, we set the DefaultAccountStoreID parameter to populate the “Select Account Store” field with the selected account store.
Click the edit button for the parameter, enter the appropriate Value, and click Save.
Configure any other parameters as needed.
Step 2: Execute the workflow
Run the “Onboard Application” workflow to initiate the onboarding process for a PBAC application.
Sign in to Resource Admin as at least a user with the Application RBAC Owner Management Role.
Under “Applications,” select the Workflows tab and click Onboard a Non-Azure Application.
This opens the Onboard Application wizard workflow.
Please note that based on the selected workflow parameter settings, the fields displayed may differ from those below.Follow the wizard and fill in the fields of each workflow section with the appropriate information for your application.
Field | Description | Action |
|---|---|---|
Name | Name of the application | Enter the name of the application, without spaces or special characters. |
Display Name | User friendly name of the application | Enter a display name for the application. |
Description | Brief characterization of the application | Enter a description. |
Select a Location | EmpowerID location to be used for RBAC access to the application. | Select an EmpowerID location for the application. |
Select Account Store | Inventoried account store (directory) with application resources. In most cases, EmpowerID should be selected. | Select the inventoried account store (directory) with the resources the application applies to. |
PBAC App | Specifies whether the application is a PBAC app. When selected, EmpowerID creates a Resource Module for the application. | Select this option to specify that the app is a PBAC app. |
App Authorization Model | Defines the framework within the application for managing user access to its data, specifying how permissions are structured and enforced. | Select the appropriate app authorization model. For example, if the app does not have any app resources stored in the EmpowerID Identity Warehouse for access control, but does have field types, you would select “PBAC App: No App Resources, Yes Field Types.” |
Allow Shop for Role Definitions | Specifies whether users can shop for any role definitions created for the application. | Enable/disable the setting for your situation. |
Allow Shop for Rights | Specifes whether users can shop for any rights created for the application. | Enable/disable the setting for your situation. |
Allow Shop for App Management Roles | Specifies whether users can shop for any Management Roles created for the applications. | Enable/disable the setting for your situation. |
When onboarding an application, it's essential to specify the individuals responsible for its management and oversight. This includes designating the responsible party, owners, and deputies.
Field | Description | Action |
|---|---|---|
Responsible Party | Identifies the primary individual accountable for the application. | Type in the full name of the person who will take responsibility for managing the application. This field is mandatory. |
Owners | Lists the people who have ownership rights over the application. | Enter the names of the individuals designated as owners, one at a time. Providing owner information is optional but recommended for better governance. |
Deputies | Specifies secondary contacts or assistants to the owners. | Input the names of individuals assigned as deputies, one at a time. Including deputy information is optional. |
When making an application requestable in the IAM Shop, it is crucial to configure several settings that dictate how requests are handled and who can access them.
Field | Description | Action |
|---|---|---|
Set Requestable Setting | Specifies if users can request access to the application in the IAM Shop. | Enable the "Set Requestable Setting" to make the application available to eligible users in the IAM Shop; otherwise, disable the setting. |
Select Access Request Policy | Defines the policy to be used for processing application requests. | From the "Select Access Request Policy" dropdown, choose the policy that best fits how you wish to handle incoming requests for the application. For applications, the Default policy is suggested. This policy routes access requests to application owners for approval. |
Eligible to Request | Specifies users allowed to request access to the application. | Select the assignee type (e.g., Person, Group, Management Role) and then identify the individuals, groups, or roles eligible to make requests. |
Pre-approved for Access | Specifies users who are pre-approved for access to the application, bypassing the need for manual request approval. | Select the assignee type (e.g., Person, Group, Management Role) and then identify the individuals, groups, or roles pre-approved for the application. |
Suggested Assignees | Identifies users who will see the application as a suggested resource that they can request. | Select the assignee type (e.g., Person, Group, Management Role) and then identify the individuals, groups, or roles suggested for application access. |
Review the summary information for the application and then click Submit.
Click Submit to close the Operation Execution Summary and exit the wizard.
Confirm the Results
After completing the workflow, verify that the application appears in Resource Admin and the IAM Shop (if configured as requestable).
Locate the application in Resource Admin and click the Details button for the application record.
On the Overview page, verify that the general information and eligibility settings match what was submitted.