Restrict Removal of Assigned Provisioning Roles in Identity Manager

Products

• CA Identity Manager

Issue/Introduction

Configure Identity Manager to restrict users from removing currently assigned Provisioning Roles while retaining their ability to assign new ones.

Environment

• Product: CA Identity Manager
• Version: 14.5, 15

Resolution

To prevent users from removing assigned Provisioning Roles, modify the Admin Task configuration as follows:

1. Log in to the Identity Manager User Console.
2. Navigate to the Admin Task you use for managing roles (e.g., Modify User).
3. Click on the Tabs tab in the task configuration.
4. Locate the Provisioning Roles tab in the list and click Edit.
5. On the configuration page that appears, look for the list of available actions or constraints. You will see checkboxes or configuration options related to the "Provisioning Roles" tab settings.
6. Ensure that the option to "Delete" or "Remove" assigned roles is unchecked or restricted in your configuration.
7. Click OK to save the tab configuration.
8. Click Submit on the main Admin Task configuration page to apply your changes.

When you select this custom Modify User task, the Provisioning Roles tab will now display the roles as assigned, but the option to remove them will be disabled or hidden, ensuring users can only add new roles.