IIQ Engineer key terms

A configuration object that tells IdentityIQ how to reach a target system, which connector to use, what connection parameters apply, and which account and group object types to collect.

The integration component that performs the actual communication with a target system, such as JDBC, LDAP, or web services, providing the read and write operations used by an application definition.

A Windows-based agent that IdentityIQ calls to run Active Directory and Exchange operations needing native Windows APIs, such as creating accounts, setting passwords, and changing group membership.

The set of object types, attributes, and entitlement types IdentityIQ builds for an application, determining what data is aggregated and which fields provisioning policies can use.

A task that reads accounts from a target system, creates or updates links between those accounts and identities, and stores the attribute values used for correlation and provisioning.

A task that collects group objects, such as directory groups or permission profiles, so their memberships can drive entitlement assignment, role modeling, and authorization analysis.

The process that decides which identity an aggregated account belongs to, using attribute matching, rules, or both; poor correlation produces duplicate identities or attaches accounts to the wrong person.

The single record IdentityIQ keeps for a person, holding identity attributes, links to accounts on each application, assigned roles, entitlements, and current policy violation state.

A task that recalculates identity attributes, role assignments, entitlements, and policy violations for selected identities so their access reflects current source data and configuration.

Field-level instructions that control how IdentityIQ builds an account creation or modification request for an application, including which fields are required, hidden, or generated by a rule.

The structured set of account requests and attribute changes generated for one identity, which is compiled into provisioning projects and executed against each target application.

The access request, approval, and fulfillment portion of IdentityIQ, used by business users to request access and by administrators to manage account creation and modification.

A submitted request for roles, entitlements, or accounts that moves through approval workflows and then generates provisioning actions on the target systems.

A configuration that fires an action, such as sending an email or launching a workflow, when an identity's attributes or assigned access meet defined change conditions.

A named collection of entitlements and profiles that can be assigned, requested, and certified as a unit, possibly with required and excluded members that shape its membership.

A role described in organizational rather than technical terms, usually containing other roles instead of raw entitlements, giving business users a requestable and reviewable view of access.

A role built directly from entitlements on one or more applications, used to model the technical access a job function needs and to drive provisioning and certification.

A unit of access on a target system, such as a group, permission, or profile, collected during aggregation and available for assignment, request, certification, and policy evaluation.

Analysis of existing entitlement assignments to find common access patterns that can become candidate roles, usually performed before or alongside manual role design.

The process of expanding assigned roles into their contained entitlements and profiles so effective access, provisioning requirements, and policy violations can be computed.

A rule that declares access combinations no single person should hold, letting IdentityIQ flag identities, roles, or requests that would create the forbidden combination.

A recorded finding that an identity, role, or request breaches a configured policy, carrying a severity and a status such as open, mitigated, or remediated.

A review in which designated reviewers confirm or revoke other users' access, producing decisions that are tracked and can trigger automatic remediation.

The template behind a certification, specifying which identities and access are in scope, who reviews them, deadlines, and escalation, from which individual certification instances are generated.

The follow-up work after a certification decision or policy violation where revoked access is removed through provisioning and completion is tracked until closed.

A numeric value derived from the severity and number of policy violations and other risk factors on an identity, used to prioritize reviews and remediation work.

A partition of identities, applications, and roles that limits what a given administrator or reviewer can see and act on within a shared deployment.

A defined sequence of steps, approvals, scripts, and subprocesses that automates a business process such as access approval, identity creation, or joiner processing.

A named hook containing BeanShell or Java code that customizes platform behavior, for example during correlation, plan building, before provisioning, or workflow execution.

A rule that transforms raw aggregated account attributes before correlation and customization, used when source data must be reformatted, combined, or cleaned first.

A workflow step where designated owners or managers must accept or reject a request before provisioning continues; approvals may be serial, parallel, or assigned by rule.

The main configuration file holding database connection settings, authentication mode, and other environment properties that must be correct for the application server to start.

A command-line tool connected to the IdentityIQ database that lets administrators import and export objects, run tasks, execute rules, and inspect configuration without the web interface.

An administrative web page that shows system settings, task results, installed patches, and configuration objects, commonly used to inspect and sometimes edit objects while troubleshooting.

Applying a vendor patch release on top of an installed IdentityIQ version, updating shipped files and the database schema while keeping custom configuration and existing data.

A stored, schedulable unit of work such as an aggregation, identity refresh, report, or certification generation, with its parameters, schedule, and notification settings.

An XML file of configuration objects that IdentityIQ imports at startup or on demand, commonly used to move custom rules, workflows, and other objects between environments.

Configuration that maps a source attribute from an authoritative application to an identity attribute, determining how values such as name, email, and manager are populated.