Direct Resource Assignments

There are several processes and features that will create a Resource assignment object for a self-management resource.

Access Request of Self-Management owner resources

When users explicitly want to request to be a manager of an object, they can use several resources like Org. Unit Manager Role and Resource Owner Role that represent ownership of objects.

They can be requested through an Access request process where the owned object is specified as an attribute.

Request an assignment

In this example, Emma Taylor goes to the Request Access view, and requests the Organizational Unit Manager resource with Invest Chicago as the attribute value.

If approved, it will be calculated by RoPE as a Calculated Resource Assignment with the reason Direct:

Then, the Effective owner property (in this case Manager) will be updated for the owned object:

Revoking the assignment

The assignment can be revoked in the Identities view, or through a survey (for example, Access Review or Transfer Identity Assignments). See Revoking assignments for the detailed procedure how to revoke assignments.

The direct resource assignment can also have an expiry date which will automatically remove the assignment at the end of the validity date, and finally, an administrator can delete the Resource Assignment (not recommended in production environments for audit and traceability reasons).

Expire direct assignments

If an identity is terminated, the identity's direct assignments (or Resource Assignment objects) are also terminated, for example, if the owner of the identity is at some point re-hired to a company, this feature can prevent an identity from re-gaining permissions that they had before the termination of the identity.

The termination of the assignments is ensured by a time-based, daily event definition that checks if there are identities with active direct resource assignments, whereby the Valid To date (or validity) of the identity was reached more than 'x' (this is configurable) number of days.

This ensures that if the identity is re-hired after x+1 day, then the direct assignments do not become active again and must be re-requested.