Entitlements

Entitlements are specific permissions given to an account in an onboarded target application. Each entitlement correlates to a permission.

Identity Governance aggregates entitlements from onboarded target applications into a centralized repository called the entitlements catalog, providing a unified view of the entitlements.

The entitlement catalog gives you the ability to view the granular access (entitlements) users in Identity Cloud have for accounts in onboarded target applications.

When you view entitlements, you can do the following:

View and populate the entitlement glossary attributes you create for each entitlement.
Manage the entitlement owner.
View the entitlement properties in the onboarded target application and accounts associated with the entitlement.

Load entitlements into Identity Cloud

Entitlements are pulled into Identity Cloud when you onboard a target application. Entitlements rely on an object to be configured when you onboard a target application. This object, known as a non-account object (NAO), is the object that represents entitlements (permissions) in the onboarded target application.

In many cases, there is no action on your part to set up a NAO as many application connectors have predefined NAOs.

There are scripted applications that require you to manually set the NAO which include:

Scripted REST
Scripted Groovy
Scripted Table
PowerShell

You must populate the Display Name Attribute on the onboarded target application NAO in the Details tab.

This allows each entitlement pulled into Identity Cloud to display with a human-readable name:

From the Identity Cloud admin UI, go to Applications > Select Application.
Select the NAO that represents the entitlements in the onboarded target application.
Go to the Details tab.
Populate the Display Name Attribute with an attribute from the onboarded target application.

The following video shows an example:

For more information on NAOs when provisioning an onboarded target application, refer to synchronize an identity.

View entitlements

When you load entitlements into Identity Cloud, they appear in the left navigation pane under the Entitlements tab. All onboarded target applications that have entitlements appear on this screen.

There are three tabs that appear on the entitlements screen:

Details - Shows the entitlement owner of the entitlement as well as the entitlement glossary attributes.
Object Properties - Displays the entitlement data as it is in the onboarded target application.
Users - Shows the Identity Cloud user and the corresponding user entity in the onboarded target application.

Modify entitlement owner

Entitlement owners are individuals responsible for the entitlements in Identity Cloud.

You can select the entitlement owners to be the certifiers (reviewers) of the certification when you define Who will Certify in an entitlement assignment certification.

To modify an entitlement owner:

Select Entitlements from the left navigation pane.
Select the desired entitlement.
On the Details tab, click the Entitlement Owner field.
Select the user to be the entitlement owner.
Click Save.

Enhance entitlements with glossary attributes

When you create entitlement glossary attributes, they appear as metadata you can populate for each entitlement.

To enhance entitlements:

Select Entitlements from the left navigation pane.
Select the desired entitlement.
On the Details tab, populate the glossary attributes you created.
Click Save.

Example of when to use the governance glossary

There are many scenarios in which using identity glossary attributes can provide useful business logic to make decisions.

Oftentimes, organizations have specific attributes to track users' entitlements from applications.

An example could be that you want to attach a risk score to each entitlement pulled into Identity Cloud. This could be to determine the sensitivity of the entitlement (privilege) in the onboarded target application.

Steps:

From the Identity Cloud admin UI, click Glossary.
Click Entitlement > + Entitlement Glossary Item.
Enter the following values:
1. Name - riskScore
2. Display Name - Risk score
3. Type - Number
  
  For more information, refer to create entitlement attribute.
Once you create the entitlement glossary attribute, it displays as metadata for each entitlement. To view this metadata in an entitlement, go to Entitlements > Select entitlement to view the attribute under the Details tab.
Assign a risk score of 80 using the newly created Risk score attribute. The higher the risk score for an entitlement, the more sensitive operations that entitlement allows.

Now that you have created an entitlement glossary attribute and enriched existing entitlements with the Risk score attribute, you can leverage this new business-relevant data.

For example, you can create an entitlement assignment certification template that filters the template to show entitlements to review that have a Risk score of 75 or higher. This allows you to certify highly-sensitive entitlements.

This is just one scenario in which the identity glossary can be used. Create identity glossary attributes for applications, entitlements, or roles to suit your business cases.