Roles for Identity or Access Management

Administration Guide › Role Planning › Creating Additional Administrators › Roles for Identity or Access Management

Roles for Identity or Access Management

To enable management of user identities and their access to other accounts, CA IdentityMinder provides two types of roles. With an admin role, a user can manage users, such as modifying a user password or group membership. Admin roles can also include any task that appears in the User Console. With a provisioning role, a user has access to other business applications, such as an email system.

Further details about roles are outlined in the following table:

Type of Role	Purpose
Admin role	Contains admin tasks that, when granted that role, a user can perform in CA IdentityMinder, such as tasks for managing users.
Provisioning role	Contains account templates that define accounts that exist in managed endpoints, such as an email system. The account templates also define how user attributes are mapped to these accounts.
Access role	Access roles provide an additional way to provide entitlements in CA IdentityMinder or another application. For example, you can use access roles to accomplish the following actions: Provide indirect access to a user attribute. Create complex expressions. Set a profile attribute that another application can use to determine entitlements.

Type of Role

Purpose

Admin role

Contains admin tasks that, when granted that role, a user can perform in CA IdentityMinder, such as tasks for managing users.

Provisioning role

Contains account templates that define accounts that exist in managed endpoints, such as an email system. The account templates also define how user attributes are mapped to these accounts.

Access role

Access roles provide an additional way to provide entitlements in CA IdentityMinder or another application. For example, you can use access roles to accomplish the following actions:

Provide indirect access to a user attribute.
Create complex expressions.
Set a profile attribute that another application can use to determine entitlements.