RapidIdentity Cloud Product Guide

Sponsorship Settings

The Sponsorship Settings options allow administrators to configure specific DN settings, attributes, and defines the alternate actions that Sponsors can perform.

Access the Sponsorship Settings menu by clicking Settings button in the People module and choosing Sponsorship Settings.

Sponsorship_Settings_Main.png

The right sidebar will have three tabs:

Sponsorship_Settings_Right_Sidebar.png
Sponsorship Settings - General Tab

The Sponsorship Settings - General Tab allows administrators to configure specific settings along with several others, which are similar to the corresponding Roles Settings right sidebar.

Sponsorship_General_Page_2.jpg
Table 27. Sponsorship Settings - General Tab Fields

Field Name

Description

Maximum Expiration Days

The maximum number of days a sponsored account can go without recertification before expiring. The default value is 90 days and the maximum number is 999 days.

Require Expiration Dates

Determines if expiration dates are required or optional.

Require Email Address

Determines if an email address is required or optional.

User Object Naming Convention

This option controls how sponsored account usernames are generated. Three options are available out of the box: Forward, Reverse, and Email.

  • Forward:

    First initial + last name (e.g. JSmith), or, if unavailable,

    First 2 initials + last name (e.g. JASmith), or, if unavailable,

    First initial + last name + incremental (e.g. JSmith1) up to 999 increments

  • Reverse: Last name + first initial (e.g. SmithJ), or, if unavailable,

    Last name + first two initials (e.g. SmithJA), or, if unavailable,

    Last name + first initial + incremental (e.g. SmithJ1) up to 999 increments

  • Email: Email address of the sponsored account.

    Note

    The Require Email Address checkbox must be selected for this setting to function properly.

User Object Naming Prefix

Text value to append before the username of newly created sponsored accounts. For instance, if Spons- was supplied for this value a new account might look like this: Spons-JSmith. Keep in mind that users will log in to systems with this account in most cases and some systems may have limitations on length and what characters are supported.

User Object Naming Suffix

Text value to append after the username of newly created sponsored accounts. For instance, if Spons- was supplied for this value a new account might look like this: JSmith-Spons. Keep in mind that users will log in to systems with this account in most cases and some systems may have limitations on length and what characters are supported.

Preload Sponsors

Enable or disable the preloading of sponsors in sponsor chooser dialogs. Only enable if the number of sponsors in your organization is relatively small.

Preload Sponsored Accounts

Enable or disable the preloading of sponsored accounts when visiting at Roles Tab.

Enable Wildcard (*) Searches

Enables/disables the ability to do wildcard searches in any tab.

Access Control

Specify whether access control should exist, and if so whether it is role-based or attribute-based.

Review the  Configuration Module Interface Overview to configure RBAC or ABAC module visibility.



Sponsorship Attributes

The Sponsorship Attributes page allows administrators inclusion/exclusion options with respect to Sponsorship filtering.

Sponsorship_Attributes_Tab.jpg
Table 28. Fields

Field Name

Description

Use First Name in Duplicate Matching Filter

If selected, the new account must match this and all other attributes selected to be considered a duplicate.

Use Last Name in Duplicate Matching Filter

If selected, the new account must match this and all other attributes selected to be considered a duplicate.

Use Email Address in Duplicate Matching Filter

If selected, the new account must match this and all other attributes selected to be considered a duplicate.

Use User Name in Duplicate Matching Filter

If selected, the new account must match this and all other attributes selected to be considered a duplicate.



Sponsorship Actions Page

The Sponsorship Actions page defines the selected actions that will be available to users who have access to the corresponding My/Team/Other Sponsorship tabs. This also allows administrators to determine what actions these users can perform for other sponsored accounts. This also defines the actions that those sponsored accounts will be able to perform once created.

Sponsorship_Actions_Page.jpg
Table 29. Sponsorship Actions

Field

Definition

Create Account

Allow users to create new sponsored accounts

Note

Unchecking this will not disable the Add Person button on the My Sponsored Accounts page.

Edit Account

Allow qualified users to edit their sponsored users' accounts

Transfer Account

Transfer this sponsored user to another sponsor

Expire Account

Force an expiration on the sponsored account to remove access to the system

Certify Account

Immediately enable authentication credentials for a sponsored account

Delete Account

Immediately remove the sponsored account from the directory.

Note

The Expire action is a safer choice than Delete because expiring the account removes access while retaining the account within the directory.



Table 30. Sponsorship Actions - Other Sponsored Users

Field

Definition

Create Account

Allow sponsored users to create accounts for further users

Note

Unchecking this will not disable the Add Person button on the My Sponsored Accounts page.

Edit Account

Allow sponsored users to edit their sponsored users' accounts

Transfer Account

Allow sponsored users to transfer one of their sponsored users to another sponsor

Expire Account

Allow sponsored users to force an expiration on one of their sponsored accounts to remove access to the system

Certify Account

Allow sponsored users to enable authentication credentials for one of their sponsored accounts

Delete Account

Allow sponsored users to immediately remove one of their sponsored user's accounts from the directory

Note

The Expire action is a safer choice than Delete because expiring the account removes access while retaining the account within the directory.