Roles for Identity or Access Management

Identity Management Service › Identity Management Administration Guide › Role Planning › Creating Administrators › Roles for Identity or Access Management

Roles for Identity or Access Management

To enable management of user identities and their access to other accounts, CA CloudMinder provides the following types of role:

Type of Role	Purpose
Admin role	Contains admin tasks that, when granted that role, a user can perform in CA CloudMinder, such as tasks for changing a user password or group membership. Admin roles can also include any task that appears in the User Console.
Provisioning role	Contains account templates that define accounts that exist in managed endpoints, such as an email system. The account templates also define how user attributes are mapped to these accounts.
Access role	Access roles provide an additional way to provide entitlements in Identity Management or another application. For example, you can use access roles to accomplish the following actions: Provide indirect access to a user attribute. Create complex expressions. Set a profile attribute that another application can use to determine entitlements.

Type of Role

Purpose

Admin role

Contains admin tasks that, when granted that role, a user can perform in CA CloudMinder, such as tasks for changing a user password or group membership. Admin roles can also include any task that appears in the User Console.

Provisioning role

Contains account templates that define accounts that exist in managed endpoints, such as an email system. The account templates also define how user attributes are mapped to these accounts.

Access role

Access roles provide an additional way to provide entitlements in Identity Management or another application. For example, you can use access roles to accomplish the following actions:

Provide indirect access to a user attribute.
Create complex expressions.
Set a profile attribute that another application can use to determine entitlements.