IIQ Engineer flashcards
IIQ Engineer · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- iiq.properties
- Config file holding database connection, keystore path, plugin list, and home-directory settings for the IdentityIQ application server.
- iiq console install
- Creates the initial IdentityIQ database schema and loads the base configuration objects; used only on a fresh, empty database before first startup.
- iiq console upgrade
- Applies the schema changes and configuration updates required to move an existing IdentityIQ database from an older release to the current version.
- Check Configuration task
- Built-in task that validates database connectivity, keystore access, plugin state, and object configuration; run it after install, upgrade, or major configuration change.
- Loss of keystore file
- If the keystore file is lost, values stored encrypted in configuration, such as application passwords, cannot be decrypted and must be re-entered manually.
- Delimited File connector
- Connector that reads accounts from CSV-style files; it requires a file location, delimiter, header-row setting, and a defined account schema with attribute types.
- Application correlation configuration
- Maps account attributes from an application to identity attributes so that aggregated accounts attach to the correct identity cube during aggregation and refresh.
- Authoritative application
- Application flagged as the authoritative source of identity data; its accounts create new identity cubes and update identity attributes during aggregation.
- Account aggregation task
- Task that reads accounts from an application through its connector and creates or updates Link objects on the matching identity cubes.
- Provisioning policy
- Form-based definition of the fields, defaults, and validation required when creating, updating, or deleting an account on an application.
- Refresh Identity Cube
- Recomputes identity attributes, correlates accounts and managers, detects and assigns roles, and runs policy scans for the identities in scope.
- LCM Provisioning workflow
- Default workflow that converts approved access requests into provisioning plans, executes the plans against applications, and records the outcome.
- Provisioning plan
- Object containing one or more account requests; the provisioner compiles it into per-application provisioning projects and executes the requested operations.
- Identity trigger rule
- Rule that fires on identity create or attribute-change events and drives lifecycle behavior such as joiner, mover, or leaver processing.
- Link object
- Record associating one identity cube with one account on a specific application, storing that account's attributes and assigned entitlements.
- IT role
- Role whose profile constrains application entitlements directly; assigned to identities manually or by propagation and used to drive provisioning.
- Business role
- Role whose profile lists other roles and membership criteria; used to group IT roles for business-level assignment, approval, and certification.
- Role profile constraint
- Filter on application, attribute, or entitlement values that determines which accounts and entitlements a role matches during role detection.
- Role propagation
- Process that assigns or removes roles for identities based on business role membership criteria and the role hierarchy.
- Separation of duty policy
- Policy defining combinations of roles or entitlements that must not be held by the same identity; violations are created when a scan detects them.
- Policy scan task
- Task that evaluates policy definitions against identities and creates or updates PolicyViolation objects for each conflict it detects.
- Certification sign-off
- Final phase of a certification campaign in which the campaign owner reviews completed decisions and formally closes the campaign.
- Certification remediation
- Post-decision process that revokes, modifies, or mitigates access according to reviewer decisions made during the certification campaign.
- Entitlement owner certification
- Certification in which the owner assigned to each entitlement reviews which identities hold that entitlement and approves or revokes it.
- BeanShell rule
- Custom code attached to applications, workflows, or tasks; it runs in the IdentityIQ context with access to the sailpoint API and a log object.
- Workflow step
- Building block of a workflow definition; types include approval, script, subprocess, condition, and end, connected to each other by transitions.
- Identity attribute transform
- Configuration that computes an identity attribute value from source attributes using operations such as concatenation, case conversion, date formatting, or a rule.
- WorkflowCase object
- Persistent record that tracks the state, variables, and pending approvals of a running workflow instance until it completes.
- checkConfig console command
- Console command that validates installation configuration, database connectivity, and required settings without starting the full application server.
- TaskResult object
- Stored record of a task run containing status, timing, messages, and exceptions, and the primary source for troubleshooting failed tasks.
- Aggregation partitioning
- Splitting a large aggregation into several concurrent tasks by defining partition boundaries so each task processes a subset of the accounts.
- Clear object cache
- Console or debug-page action that flushes IdentityIQ's in-memory object cache so changed configuration objects reload immediately.