Provisioning
The Cerner Healthcare connector supports provisioning, allowing you to create and manage accounts and entitlements in Cerner Healthcare directly from SailPoint.
Prerequisite: Your system is configured for provisioning.
When SailPoint provisions new accounts to the source, it uses the attributes on the Create Account page as instructions or a template for what to include in the account. This page is also referred to as the provisioning policy.
When new access is granted on a source where a user does not already have an account, SailPoint automatically includes account creation in the provisioning. This applies whether provisioning is started from an access request or from an automated role or lifecycle state assignment.
For direct-connect sources, SailPoint automatically creates the account from this configuration. If the source is not configured as a direct-connect source, SailPoint creates and assigns a provisioning task to the source owner and includes the values for the source owner to use in manually creating the account.
Important
This section describes the default Create Account configuration. SailPoint recommends that you work with Services to define a provisioning configuration specific to your company's needs. Be sure to verify large changes to the provisioning policy before implementation. Failure to do so might cause provisioning to fail.
Note
The confidentialityLevel attribute must be configured in the new application provisioning policy with the following details:
- Type as String
- Review required
For better governance, ensure that the value of the confidentialityLevel attribute is the same as the managed system.
Default Create Account Attributes
The following table lists the provisioning policy attributes for Create Account:
| Account Attribute | Description |
|---|---|
| username | The user name associated with the account. The value of the user name field must be unique within the target Cerner Millennium domain [1-48 characters]. |
| password | The password for the user account. Any value, assuming that value meets all criteria defined in the Cerner Millennium password policy maintained in AuthView. The password is only required when the user being provisioned is a non-LDAP user (when the user will authenticate against the Cerner Millennium user directory). |
| first name | Given (first) name for the personnel. |
| lastname | Surname (last name) for the personnel. |
| confidentialityLevel | The confidentiality level set for organization or organization groups. |
Update Account Attributes
The following table lists the provisioning policy attributes for Update Account:
| Account Attribute | Description |
|---|---|
| confidentialityLevel | The confidentiality level set for organization or organization groups. |
Dormant Account Support
If you want to remove the user name and not disassociate an account, clear the Disassociate Account checkbox on the Advanced Settings page.
To remove the user name, configure the following attribute in the provisioning policy:
<entry key="disassociateAccount" value="true"/>
If you set the attribute to true, the source removes the user name and disassociates the account from personnel. This disassociated user name can then be assigned to any other account.
Additional Provisioning Attributes
The following are additional provisioning attributes:
| Account Attribute | Description |
|---|---|
| personnelAlias | To provision personnelAlias through the update account provisioning policy, enter the input format for the attribute as follows: beginEffectiveDateTime=2021/10/01#~#endEffectiveDateTime=2100/12/30#~#alias=677001#~#type=DOCDEA#~#aliasPool=DEA |
| credential | To provision credential through the update account provisioning policy, enter the input format for the attribute as shown in the following example: name=BLS#~#type=Certificate#~#renewalDateTime=2035/01/01#~#state=NY#~#beginEffectiveDateTime=2021/10/01#~#endEffectiveDateTime=2100/12/30#~#addToNameIndicator=true |
| address | To provision address through the update account provisioning policy, enter the input format for the attribute as shown in the following example: streetAddr=1200 Northside Forsyth Dr#~#streetAddr2=Times Square#~#addressTypeCd=Business#~#state=NY#~#city=Cumming#~#zipCode=30041#~#beginEffectiveDateTime=2021/10/01#~#endEffectiveDateTime=2100/12/30 |
| phone | To provision phone through the update account provisioning policy, enter the input format for the attribute as shown in the following example: phoneNumber=0001112222#~#phoneType=Business#~#phoneFormat=FreeText#~#extension=09#~#description=A phone number#~#beginEffectiveDateTime=2021/10/01#~#endEffectiveDateTime=2100/12/30 |
| roleProfile | To provision roleProfile through the update account provisioning policy, enter the input format for the attribute as shown in the following example: position=0001112222#~#display=Displayname#~#beginEffectiveDateTime=2021/10/01#~#endEffectiveDateTime=2100/12/30 |
Documentation Feedback
Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.