IdStory Identity Manager

• Password change for other user (as administrator) - there is no choice of using Password generator. I see it as natural place to use the component we already have...

• audit log -> entity history. When searching for changes on entity relations e.g.:
  • Role <-> ( Contracted position <-> ) Identity
  • Role <-> Permissions
  • Identity <-> Contracted position
    every one of them.

it is absolute, total, bottomless HELL :-D IDs everywhere, no idea where to search for the relationship entity name. No chance to find anything!!! (except you are devil).

Sorry for my language, I know you love me still, guys.

Marcel Poul wrote:

• audit log -> entity history. When searching for changes on entity relations e.g.:
  • Role <-> ( Contracted position <-> ) Identity
  • Role <-> Permissions
  • Identity <-> Contracted position
    every one of them.

it is absolute, total, bottomless HELL :-D IDs everywhere, no idea where to search for the relationship entity name. No chance to find anything!!! (except you are devil).

Totally agree. Please consider following use-case of the most common support incident:

Identity xyz can't login to IdM, or AD,.... Their attributes/roles/block status/... are wrong. Explain why IdM did this!¶

You don't know when, you don't know who, you don't know why the identity has wrong settings. You need to find ALL changes that happened on this specific identity during last weeks, months or even years. Then you can find the reason (which can be really anything, e.g. administrator made mistake, a personalist made some typo in HR system and contract went inactive, manager accidentally resetted password or disabled the user, approver denied approval task for role even if he thought he approved it, synchronization didn't handle the user in last few weeks, personal processes started something unexpected,...) and you can prove that IdM works as it should.
Therefore you need to be able to filter all changes and relations for one specific identity historically. Even for contracts that are no longer active, roles that are no longer used,...

On forms with the hierarchy tree (roles administration, organization) the list can be filtered. The filter can be added by clicking on some node in the tree component. This is can be very confusing to the user. Consider following.
You have organization tree in the roles administration which looks like:

SAP
  |_ SAP PAM
  |_ SAP CUA

Apart from the filter form fields, there is no way to tell what happened. Applying a filter does not generate clearly visible output for the user. Also, there are three fields (Name, Type, Složka v katalogu) in the roles administration and there is no clear distinction of what they do. Maybe add a "Filtering options" label?

I am unable to see current accout attributes directly on connected end system like LDAP. Hence I am not able to check if the accout was created as I expected or that somebody changed it since then.

What really confused me and I think will confuse the admins of the CzechIdM is that when you see user detail and its Accounts, you do not see the real state of the account on end system. You can see the state of the accout in CzechIdM. So you always have to check the provisioning Active operations on the systeme, if there is any error.

e.g. you add role LDAP to the user and expect that the account is created on the LDAP system. You look into user detail and Account and you see the line with the account. But it only means that account is created in IDM not that the provisioning was done and the account is created in LDAP. If there was an error - my case: wrong DN for the user, you still believe that the account exists.
I think that there shout be some info about real state on the system - on demand fetch data. + There should be some bold info message on the GUI that those account are offline infos and how to get real info.

Scheduler -> Scheduled tasks - When I click on the green arrow with alt text "Run Manually" Message "Task [NAME] successfully started" shows up. But in fact it only shows itself on All tasks window. Where It stays in state "Created" until I click again on "Run Created tasts". All mechanism is very confusing for me. I really do not like that I have to start the task twice. It confuse me, that after first start, there is nothing in the "Running task" window. Also state "Created" is confusing for me. If it waits for something (manual or planned run), I would explect somethink like "Waiting for start" state or similar.

• I always click on the system name in the connected system agenda of role, which takes me to the system configuration. Then I have to go back and search and click on that little hand glass button, which is just as gray as the background.
• apparently attribute mapping in roles and systems agenda are pretty same, but have different localization
• when I choose some attribute to overload, I'd expect some kind of hint, like preset how is the attribute mapped on the system
• at least choosing mapping strategy and identifier seems to be redundant in role agenda

Email templates configuration does not preserve original search filtering / table pagination / number of rows per table.

• in most cases, there is only one org. structure tree type - fill it in immediately
• for first created contract, tick "main" contract by default