Oracle Identity Cloud Service: Implementing Hybrid Certification

In this section, you configure the OIM risk level for the Identity Cloud Service application instance and entitlements.

1. Access the OIM Identity Self Service console (https://oim.example.com:14000/identity) as administrator (xelsysadm).
2. Click Request Access > Request for Self.
3. Click the information icon next to the JCS Administrators entitlement.
4. Change the risk level to High Risk, click Apply, and then close the Detailed Information page.
5. Change the risk level for the remaining Identity Cloud Service items according to the table:

OIM - risk level for Identity Cloud Service catalog items

Item	Risk Level
Marketing Cloud Users	Medium Risk
Identity Cloud Services Application Instance	Low Risk

1. Click Compliance.
2. Click Identity Certification > Definitions.
3. Click Create.
4. Create the Cloud Access Review certification definition with the following properties:

OIM - Cloud Access Review certification definition properties

Step	Attribute	Value
General Details	Name	Cloud Access Review
	Type	Application Instance
	Description	Certification review for systems in the cloud
Base Selection	Base Selection	Selected Application Instances Only
	Selected Application Instances	Identity Cloud Services Application Instance
Content Selection	Content Selection	Accounts of All Users
Configuration	Perform closed loop remediation	selected
Reviewers	Primary Reviewer	Search for a User (XELSYSADM)

5. Verify your selections in the Summary step and click Create. In the Certification Job dialog, click Yes.
   OIM displays a confirmation message and creates certifications to review users provisioned to the Identity Cloud Services application Instance and its entitlements.
6. Click Self Service and then click Certifications.
7. Confirm that OIM displays the Cloud Access Review [System Administrator] pending certification:



This confirms that the Cloud Access Review assigned a certification object for XELSYSADM. In the next section, you complete this certification.

1. Click the Cloud Access Review [System Administrator] certification.
2. Click the Identity Cloud Service Application Instance entry.
3. Expand the Display Name column. The certification page displays the user accounts that must be certified or revoked as part of the cloud access review.

   

4. Select BMACELWEE and click Revoke, enter Bettina is not working with our cloud systems as comment and click OK.
5. Select and certify all the remaining accounts and entitlements.

   

6. In the Sign-off box, enter the xelsysadm password and click OK.
   OIM displays a confirmation message and starts the closed loop remediation (revocation request) for BMACELWEE.

1. Log out of Identity Self Service as XELSYSADM.
2. Access Identity Self Service as BMACELWEE.
3. Click Pending Approvals, and then click the Challenge Task request.
4. In the request details page, confirm that the justification, the request type, and the Cart Items display relevant information about the revocation, and then click Accept.

   

5. Close the pending approvals window.

1. In Identity Self Service console as BMACELWEE, click My Access and then click Accounts.
2. Confirm that the Identity Cloud Service application Instance account status is Revoked.

   

   This indicates that the closed loop remediation worked.
3. Log out of the Identity Self Service console.
4. Optionally access the Oracle Identity Cloud Service console, expand the Navigation Drawer , click Users, and confirm that Bettina MacElwee's account no longer exists.

   

1. Access the OIM Identity Self Service console as xelsysadm.
2. Click Compliance.
3. Click Identity Certification > Dashboard.
4. In the Show field, select Completed. OIM will display the completed certifications.
5. Click Cloud Access Review [System Administrator].
6. Click the Identity Cloud Service Application Instance entry.
7. Expand the comments column and check the comment associated with BMACELWEE's revocation



8. Optionally, select the BMACELWEE row and explore the certification dashboard tabs.
   The detailed information section provides insights about the certification that includes the risk summary, certification and account history, and associated audit violations.

In this tutorial, you configured an application-instance based certification. This type of certification is used when the access is reviewed from the application instance perspective (to review who has access to Identity Cloud Service).
The OIM certification also supports user certifications. In this type of certification, the user manager (or another administrator) reviews all the access that a given user has. This includes accounts and entitlements from Identity Cloud Service and other connectors. The user-centric certification can provide functionalities such as:

• Centralized and automatic access certification campaigns compatible with regulatory requirements, such as the Sarbanes-Oxley Act (SoX) and the Health Insurance Portability and Accountability Act (HIPAA) across cloud and on premises systems.
• Automatic closed loop remediation across cloud and on premises systems.

General steps to configure the user-centric hybrid certification:

1. In OIM Identity Self Service console, create a certification definition with:
• Certification Type: User
• Perform closed loop remediation: selected
• Primary Reviewer: User Manager
Tip: In the certification scope, start with a single user or organization for testing purposes. Expand the certification scope as your company gets used to work with certifications.
2. To automate the certification execution, visit the OIM scheduler and edit the scheduled job related to your certification name (Cert_Certification Name) with:
• Schedule Type: Periodic
• Run every: 180 days (for SoX reviews)
Tip: For best results, it's recommended that you test the certification scheduler with a reduced period in a certification definition with a limited scope (single user or organization) for testing purposes. Expand the certification scope and schedule as your company gets used to work with certifications.

Event listeners provide a way to trigger OIM certifications after changes in the user profile instead of time based certifications. The event-listener based certification can provide functionalities such as:

• Access reviews when an important change happened to a user, such as when he changes his position or manager
• Centralized access certification campaigns across cloud and on premises systems with closed loop remediation

The general steps to configure the user-centric hybrid certification are:

1. In OIM Identity Self Service console, create a certification event listener associated with the certification definition of your choice.
2. Visit the OIM scheduler and edit the Certification Event Trigger Job scheduled job. Enter your event listener in the Event Listener Name List.
   The Certification Event Trigger Job, by default, runs every day to detect changes based on your event listener rules.