Skip to content
Documentation version: IdentityIQ 9.0

Using the Edit Application Page

Use the Edit Application page to configure applications for your enterprise.

The Edit Application page displays the default Details tab and includes the following additional tabs:

Note

Some tabs only appear after an application has been defined and configured.

The information on each tab is determined by the type of application specified on the Application Type dropdown list. Use these tabs to define how each application interacts with IdentityIQ.

The Edit Application page also lists any extended attributes that were configured for your deployment of IdentityIQ; these are displayed at the bottom of the tab.

For each application enter or edit the following information:

Edit Application Details Fields

Application Type

The Application Type dropdown list specifies the supported target application type (for example, LDAP or JDBC) to which IdentityIQ can connect. This list is updated as new application types are introduced or existing types are deprecated. When editing an existing application, the Application Type dropdown list is disabled and cannot be modified. However, if you do need to change the Application Type, click Reconfigure button at the bottom of the page. To learn more, see, Reconfiguring an Application.

Name

The name of the application. This is the name used to identify the application throughout IdentityIQ.

Note

In IdentityIQ the specified application name cannot be exactly 32 characters and can neither be comprised only of 0-9, a-f and A-F. Special characters ' < > " % are not allowed. There is a maximum character limit of 128 characters for the application name. The name ‘IdentityIQ’ is reserved for internal use, hence select a different application name.

Owner

The owner specified here is typically the business owner of the system, who is familiar with the system, its entitlements, and who should have access to it. The owner responsible for access reviews for this application from application owner certifications, account group permissions certifications, and account group membership certifications. The application owner can also be selected as an approver in targeted certifications.

Application ownership can be assigned to an individual identity or a workgroup. If the application ownership is assigned to a workgroup, all members share certification responsibilities, are assigned certification request associated with the application and all can take action on those requests.

Revoker

The default IdentityIQ user or workgroup to be assigned revocation requests associated with entitlements on this application. If no user is specified in this field, all revocation requests are assigned to the to application owner by default.

Proxy Application

A proxy application is an application that handles the processing (aggregation and provisioning) on behalf of your application. Configuring a proxy application is optional.

Here are some examples of proxy applications:

  • Multiplex applications: In this case you define an application and, most often, a build map rule that sorts the data out in multiple sub-applications. In that case, the sub-applications have the main application as the proxy.

  • Similar to the multiplex applications are the connectors for legacy identity management systems such as, BMC, Novell/NetIQ, IBM Tivoli, and Sun/Oracle Waveset.

  • The Cloud Gateway connector tunnels all aggregation and provisioning requests to the gateway in another network. The gateway then acts on behalf of IdentityIQ. All applications that live in the remote network need to have the cloud gateway connector set as the proxy.

Profile Class

This is an optional class used to associate this application with a larger set of applications, for role modeling purposes.

For example, you might set a profile class of XYZ on all of the applications where any user that has read account privileges should be assigned the role XYZ Account Reader. You can then create a single profile for that role instead of a separate profile for each instance of the applications. During the correlation process any user with read account privileges on any of the applications with the profile class XYZ is assigned the role XYZ Account Reader.

Description

A brief description of the application.

If your instance of IdentityIQ is configured to support multiple languages, you can use the language selector to enter description in multiple languages. The dropdown list displays any languages supported by your instance of IdentityIQ. The description displayed throughout the product is dependent on the language associated with the user's browser. If only one description is entered, that is the description used by default.

Scope

This field is only visible if scoping is enabled for your instance of IdentityIQ. When a scope is assigned, only the owner of the application or users that control the designated scope can work with this application.

Objects associated with this application, such as entitlements in a certification request, are visible to a user with any or no controlled scope, but if a new object is being created (for example, a certification schedule), this application does not appear on the select list unless the creator controls the scope assigned.

Depending on configuration settings, objects with no scope assigned might be visible to all users with the correct capabilities.

Authoritative Application

An authoritative application is a target system that represents the primary and most trusted information for employee information for your enterprise, such as a human resources application. When this option is enabled, designating this application as an authoritative one, the IdentityIQ aggregation process will create an authoritative Identity Cube for each account in this application. Note that your organization can have multiple authoritative applications.

Case Insensitive

Enable this option to cause case insensitive comparisons of account attribute values when evaluating provisioning policy.

Native Change Detection

Enable this option if this application should be included when IdentityIQ performs native change detection during aggregation.

For more detailed information about configuring native change detection, see Native Change Detection Configuration.

Native Change Definitions

Native Change Operations

Select which operations are included when detecting native changes. If no operations are selected, native change detection is disabled.

Attributes to Detected

Indicates which attributes are compared when accounts are modified. If the Entitlement option is selected, all entitlement attributes are included. If you select User Defined, enter the name of the attributes to compare in the Attribute Names box.

Maintenance: Take an application offline for maintenance

Maintenance Enabled

When maintenance is enabled, the application is excluded from provisioning and aggregation during the defined maintenance period. See Application Maintenance Windows for more information.

Maintenance Expiration

The date and time at which the maintenance will end. If no date and time are defined, this application will be in maintenance indefinitely.

After adding the application information, click Save to save your changes and return to the Application Definition page.

Note

If you navigate away, log out, refresh, go back, or change the Application Type without saving, a warning popup appears with two options: Leave/Continue (discards unsaved data and resets the page to the Details tab) or Cancel/Stay (dismisses the popup with no changes).