Implementation Guide › Planning Your Implementation › Develop a Deployment Plan › Deploy Identity Policies

Deploy Identity Policies

An identity policy is a set of business changes that occurs when a user meets a certain condition or rule. You can use identity policies to provide business-driven entitlements before a complete delegation model is deployed. For example, you can create an identity policy that assigns the Sales Manager provisioning role, which grants access to sales applications, to all users whose title is Sales Manager. When a sales representative is promoted to Sales Manager, he automatically receives access to all of the systems he needs to do his job without waiting for administrator involvement.

To deploy identity policies, you complete the following steps:

1. Configure identity policies that are triggered by changes to user profile attributes.
2. Configure the User Manager role to allow a small number of administrators to use user tasks, such as Create User and Modify User, to change the attributes that trigger the identity policies.

   Be sure to configure the scope rules in the User Manager member policies to determine the set of users that role members can manage.

Note the following when deploying identity policies:

• Consider initially creating identity policies that grant entitlements that do not require workflow approvals. This allows you to deploy identity policies without having to define workflow processes, approval forms, and approver models.
• Before creating identity policies, you should be familiar with other methods of implementing business rules in CA IdentityMinder, such as data validation rules, logical attributes, business logic task handlers, and workflow processes, to determine which method provides the best solution.

  Note: For more information about these methods, see the Administration Guide and the Programming Guide for Java.

• Identity policies are an efficient way to assign entitlements in CA IdentityMinder, however, they may significantly impact performance.
• For the initial deployment of user tasks, consider removing or hiding relationship tabs, such as Roles tabs, that manage the same entitlements as identity policies. This prevents the risk of unauthorized entitlements and prevents the potential performance impact of improperly constructed roles.

Note: For more information about identity policies, see the Administration Guide.

More information:

Identity Policy Optimizations