# Recertification
# Recertification policies
## Description
Soffid allows you to establish some policies to define the scope of the recertification process.
#### Menu option
`Main Menu > Administration > Configuration > Security settings > Recertification policies`
## Screen overview
[](https://bookstack.soffid.com/uploads/images/gallery/2022-05/image-1653572713094.png)
## Custom attributes
- **Name**: name to identify the policy
- **Type**: list of available recertification types.
- **User entitlements**: the recertification process will be conducted to review user access rights.
- **Role definitions**: the recertification process will be conducted to review the relationship between roles.
- **Share account entitlements**: the recertification process will be conducted to review access rights to shared accounts.
- **Filter**: this allows you to define a script to identify the grant list to which to apply the recertification process. The [**grant object**](http://www.soffid.org/doc/console/latest/uml/com/soffid/iam/api/RoleAccount.html) *(\*1)* is always available. You can use the Enumeration SoDRisk to compare:
- **SOD\_LOW**
- **SOD\_HIGH**
- **SOD\_FORBIDDEN**
- **SOD\_NA**
- **Step 1 expression**: this allows you to define a script to determine who is or are in charge to approve or deny the recertification process in the first level.
- **Step 2 expression**: this allows you to define a script to determine who is or are in charge to approve or deny the recertification process after the first level of approval.
- **Step 3 expression:** this allows you to define a script to determine who is or are in charge to approve or deny the recertification process after the second level of approval.
- **Step 4 expression**: this allows you to define a script to determine who is or are in charge to approve or deny the recertification process after the third level of approval.
- **Mail Template**: this allows you to define a template to send an email to the people in charge to approve or deny. Be in mind, that to work fine, the review process link must be ${url}
*(\*1)* **grant object** is a [com.soffid.iam.api.RoleAccount object](http://www.soffid.org/doc/console/latest/uml/com/soffid/iam/api/RoleAccount.html).
## Examples
Some sample scripts for the filters and approval steps are shown below
### Filter
Return all grants with risk.
```shell
return grant.sodRisk != null
&& grant.sodRisk != es.caib.seycon.ng.comu.SoDRisk.SOD_NA;
```
### Steps
```shell
account = serviceLocator.getAccountService().findAccountById(grant.accountId);
StringBuffer sb = new StringBuffer();
for (owner : account.ownerUsers) {
if (sb.length() > 0)
sb.append(" ");
sb.append(owner);
}
if (sb.length() > 0)
return sb.toString();
else
return "admin";
```
```shell
com.soffid.iam.api.Role role = serviceLocator.getApplicationService().findRoleByNameAndSystem(grant.roleName, grant.system);
StringBuffer sb = new StringBuffer();
List owners = role.getAttributes().get("owner");
if (owners != null) {
for (owner : account.ownerUsers) {
if (sb.length() > 0)
sb.append(" ");
sb.append(owner);
}
}
if (sb.length() == 0)
return "admin";
else
return sb.toString();
```
#### Mail template
[](https://bookstack.soffid.com/uploads/images/gallery/2022-05/image-1653470454738.png)
## Actions
#### Recertification policies query
| **Add new**
| Allows you to add a new Recertification policy. You can choose that option on the hamburger menu or click the add button (+).
To add a new it is necessary to fill in the required fields.
|
| **Delete** | Allows you to remove one or moreRecertification policies by selecting one or more records and next clicking the button with the subtraction symbol (-).
To perform that action, Soffid will ask you for confirmation, you could confirm or cancel the operation.
|
| **Import** | Allows you to upload a CSV file with the Recertification policies to add or update the attribute definition to Soffid.
First, you need to pick up a CSV file, that CSV has to contain a specific configuration. Then you need to check the content to be loaded, it is allowed to choose if you want or not to load a specific attribute. And finally, you need to select the mappings for each column of the CSV file to import the data correctly and click the Import button.
|
| **Download CSV file**
| Allows you to download a CSV file with the basic information of all Recertification policies.
|
| **Add or remove columns**
| Allows you to show and hide columns in the table. You can also set the order in which the columns will be displayed. The selected columns and order will be saved for the next time Soffid displays the page to the user.
|
#### Recertification policies details
| **Apply changes** | Allows you to **save** the data of a new policy or to update the data of a specific policy **and quit**. To save the data it will be mandatory to fill in the required fields.
|
| **Save**
| Allows you to **save** the data of a new policy or to update the data of a specific policy. To save the data it will be mandatory to fill in the required fields.
|
| **Delete**
| Allows you to remove a specific policy. You can choose that option on the hamburger icon.
To perform that action, Soffid will ask you for confirmation, you could confirm or cancel the operation.
|
| **Undo**
| Allows you to quit without applying any changes.
|
---
[*https://download.soffid.com/doc/console/latest/uml/es/caib/seycon/ng/comu/SoDRisk.html*](https://download.soffid.com/doc/console/latest/uml/es/caib/seycon/ng/comu/SoDRisk.html)
# Recertification campaigns
## Description
Soffid allows you to define new campaigns to review the users' access rights and to assign who has to recertify or revoke their entitlements.
You can create a campaign related to a previously defined recertification policy. Depending on the policy type selected, you will have to fill in some required information to create a new campaign.
To create a new campaign, will be mandatory that one or more accounts for recertification exist.
When a campaign is created, the initial status will be **Preparation**. This status will change to **Active** automatically. The **Finished** status will be when the proper users approve or deny the recertifications
#### Menu option
`Main Menu > Administration > Resources > Recertification campaigns`
## Screen overview
[](https://bookstack.soffid.com/uploads/images/gallery/2022-05/image-1653636505476.png)
## Custom attributes
#### Basic
- **Name**: name to identify the campaign.
- **Template**: select the policy that will be applied. That has to be defined previously on the [Recertification policies page](https://bookstack.soffid.com/books/recertification/page/recertification-policies "Recertification policies").
- **Groups**: list of user groups where the campaign will be applied. You can choose one or more.
- **Information Systems**: list of information systems where the campaign will be applied. You can choose one or more.
#### Others
- **Start date**: date and time when the campaign started. This field is generated automatically.
- **Finish date**: date and time when the campaign finished. This field is generated automatically.
- **Status**: recertification campaign process status. Three statuses are available:
- **Preparation**: it is the first status when the campaign is created.
- **Active**: it is the status when the recertification campaign is ready to be applied.
- **Finished**: it is the status when the recertification campaign ends.
- **Groups**: users groups list to which the campaign will be applied.
- **Group name**
- **Status**
- **% done**
- **Applications:** application list to which the campaign will be applied.
- **Application name**
- **Status**
- **% done**
- **Group members:** list of users who belong to the selected group.
- **Active**
- **User**
- **Creation date**
- **Status**
- **Step 1**
- **Step 2**
- **Step 3**
- **Step 4**
## Actions
#### Recertification campaigns query
| **Add new**
| Allows you to add a new Recertification policy. You can choose that option on the hamburger menu or click the add button (+).
To add a new it is necessary to fill in the required fields.
|
| **Delete** | Allows you to remove one or moreRecertification policies by selecting one or more records and next clicking the button with the subtraction symbol (-).
To perform that action, Soffid will ask you for confirmation, you could confirm or cancel the operation.
|
| **Import** | Allows you to upload a CSV file with the Recertification policies to add or update the attribute definition to Soffid.
First, you need to pick up a CSV file, that CSV has to contain a specific configuration. Then you need to check the content to be loaded, it is allowed to choose if you want or not to load a specific attribute. And finally, you need to select the mappings for each column of the CSV file to import the data correctly and click the Import button.
|
| **Download CSV file**
| Allows you to download a CSV file with the basic information of all Recertification policies.
|
| **Add or remove columns**
| Allows you to show and hide columns in the table. You can also set the order in which the columns will be displayed. The selected columns and order will be saved for the next time Soffid displays the page to the user.
|
#### Recertification campaigns details
| **Click group** | By clicking a record group, Soffid will display the group members' list.
|
| **Show details** | Displays a detailed list with the recertification data for each user to recertificate.
|
| **Delete** | Allows you to delete a recertification campaign. You can select this option on the hamburger menu.
It is not allowed to delete a recertification process once it has been started.
|
#### Recertification details
| **Delegate** | Allows you to delegate to another user the recertification by clicking a record group o by selecting one or more records, Soffid will display the group members' list.
|
| **Back** | Allows you to delegate the operation to approve or deny the process. Once you click the delegate option, Soffid will allow you to select one or more users to delegate the process.
|
# Recertifications to do
## Description
When a campaign is run, the pending recertifications will be displayed in the Recertifications to-do list of the proper user who has to Accept or Deny the recertification. The user who has to manage the recertification can delegate it as well to another user to manage it.
#### Menu option
`Main Menu > Recertifications to do`
## Screen overview
[](https://bookstack.soffid.com/uploads/images/gallery/2023-06/image-1687763668120.png)
## Custom attributes
#### Recertifications campaign list
- **Name**: name to identify the campaign.
- **Start date**: date and time when the campaign started.
#### Recertifications to do list
- **Group**: group to which recertification applies.
- **User**: user to whom permissions will be assigned or not. If you click the user, Soffid will display a new page with the user data.
- **Entitlement**: the role that you can assign or not to the user. If you click the role, Soffid will display a new page with the role data.
- **Previous endorsement**: status previous endorsement.
- **Pending endorsement**: allows you to select the option to approve or deny.
- **Comments**: this allows you to write a comment.
## Actions
#### Recertifications campaign
| **Click recertification**
| If you click one campaign record, Soffid will display the recertifications to do list.
|
#### Recertifications to do list
| **Pending endorsement**
| In the pending endorsement column, you can approve or deny the recertification for each user who appears on this list. You can approve or deny by clicking on the proper check
- approve -> **✓ **
- deny -> X
|
| **Apply changes** | Allows you to **save** the recertifications accepted and denied. Before applying changes, you need to select for each recertification if you approve or deny it. Also, you can write a comment.
Once you apply changes, the recertifications executed will be removed from the recertifications to do list.
|
| **Back**
| Allows you to quit without applying any changes.
|
| **Delegate**
| Allows you to delegate the operation to approve or deny the process. Once you click the delegate option, Soffid will allow you to select one or more users to delegate the process.
|
| **Browse user**
| By clicking the user, Soffid will open a new window with the user data.
|
| **Browse entitlement**
| By clicking the entitlement, Soffid will open a new window with the role data
|