OIM Entitlements for Sauron RBAC

Oracle Identity Manager (OIM) entitlements control who can access production Sauron endpoints through Oracle SSO. If your team is joining Sauron for the first time, decide who should approve access before asking Sauron support to create the entitlements.

OIM entitlement creation requires Sauron-team action. After the entitlements exist, entitlement approvers can add users and approve or reject access requests in OIM.

Which entitlement should I request?

For a team named MyTeam, Sauron creates these OIM entitlements:

Entitlement	Use it for
MyTeamAdmin	Admin users who need administrator access to the Sauron.
MyTeamViewer	Read-only users.
MyTeamEditor	Users who need Grafana Editor access for dashboards. Grafana 8.x and above only.

Request the least-privileged role that lets you do your work. If you are not sure which role you need, ask your Sauron owner or OIM approver before requesting access.

Request new entitlements

When your team needs new Sauron OIM entitlements created, post in #sauron-support with:

• Sauron URL.
• Team name. If the name is long, provide a short one-word form and avoid special characters.
• Email IDs of approvers for each OIM entitlement.

Approvers can add users and approve or reject requests for these OIM entitlements.

After Sauron support creates the entitlements, approvers need to submit requests for those entitlements in OIM. The request goes up their management chain for approval. After approval, they become approvers for the entitlements and can ask team members to submit access requests.

Ask Sauron support for the current turnaround after you provide the team and approver details. Wait for confirmation that the entitlements are ready before submitting access requests against them.

After the entitlements are ready, request access and check your sign-in.

Add users to an OIM entitlement

For your own access, open OIM, use Request Access → Request for self, and request the exact entitlement your Sauron owner provided. Include why you need it. Wait for approval, then check your sign-in.

For other team members, an authorized requester uses these steps:

1. Log in to Oracle Identity Manager.
2. Select Request Access.
3. Select Request for others.
4. Search for the users who need access. You can choose direct reports or find users by email ID.
5. Search for the entitlement name.
6. Select the entitlement and click Add to cart.
7. Click Next.
8. Enter a justification, such as members of [team] group.
9. Click Submit.

Tips and checks

• Tips: Request the exact entitlement for the intended Sauron. Check for an existing request before submitting another.
• Check: Confirm the request is approved, sign out and back in, then open the endpoint covered by that entitlement. If access is denied, compare the entitlement with the required role in User access.