Skip Headers
Oracle® Database Vault Administrator's Guide
10g Release 2 (10.2)

Part Number B25166-04
Go to Documentation Home
Home
Go to Book List
Book List
Go to Table of Contents
Contents
Go to Index
Index
Go to Master Index
Master Index
Go to Feedback page
Contact Us

Go to previous page
Previous
Go to next page
Next
View PDF

4 Configuring Factors

This chapter describes how to create and configure factors. It includes the following sections:

4.1 What Are Factors?

A factor is a named variable or attribute, such as a user location, database IP address, or session user, that Oracle Database Vault can recognize. You can use factors for activities such as authorizing database accounts to connect to the database or creating filtering logic to restrict the visibility and manageability of data.

Oracle Database Vault provides a selection of factors that lets you set controls on such components as the domain for your site, IP addresses, databases, and so on. "Default Factors" describes the default factors in detail. You also can create custom factors, using your own PL/SQL retrieval methods.

You can use factors in combination with rules in rule sets. The DVF factor functions described in "Oracle Database Vault PL/SQL Factor Functions" are factor-specific functions that you can use in rule expressions.

Factors have values (identities) and are further categorized by their factor types. "Factor Identification" explains more about factor identities. See "Factor Type" under "General" for information about factor types.

You also can integrate factors with Oracle Label Security labels. "Integrating Oracle Database Vault with Oracle Label Security" explains how. See "Example of Integrating Oracle Database Vault with Oracle Label Security" for more information.

You can run reports on the factors that you create in Oracle Database Vault. See "Related Reports" for more information.

This chapter explains how to configure factors by using Oracle Database Vault Administrator. To configure factors by using the PL/SQL interfaces and packages provided by Oracle Database Vault, refer to the following appendixes:

4.2 Creating a Factor

In general, to create a factor, you first create the factor itself, and then you edit the factor to include its identity. "Guidelines for Designing Factors" provides advice on designing factors.

To create a factor:

  1. Log in to Oracle Database Vault Administrator using a database account granted with the DV_OWNER role.

    At a minimum, you must have the DV_ADMIN role. "Starting Oracle Database Vault Administrator" explains how to log in.

  2. In the Administration page, under Database Vault Feature Administration, click Factors.

  3. In the Factors page, click Create.

  4. In the Create Factor page, enter the following settings, and then click OK:

General

In the General area, enter the following information:

Factor Identification

Under Factor Identification, select how to resolve the identity of a factor. This attribute is mandatory. The values are as follows:

A factor identity is the actual value of a factor, for example, the IP address for a factor that uses the IP_Address type. A factor can have several identities depending on its retrieval method or its identity mapping logic. For example, a factor such as Database_Hostname could have multiple identities in an Oracle Real Application Clusters environment; a factor such as Client_IP can have multiple identities in any RDBMS environment. The retrieval method for these types of factors may return different values because the retrieval method is based on the database session.

Several reports allow you to track the factor identity configuration. See "Related Reports" for more information.

You can configure the assignment of a factor in the following ways:

With the Oracle Label Security integration, you can label identities with an Oracle Label Security label. You can also assign an identity trust levels, which are numbers that indicate the magnitude of trust relative to other identities for the same factor. In general, the higher the trust level number is set, the greater the trust. Negative trust levels are not trusted.

See Also:

"Adding an Identity to a Factor" for more information about factor identities

Within a database session, a factor assigned identity is available to Oracle Database Vault and any application with a publicly accessible PL/SQL function that exists in the DVF schema (which contains functions that retrieve factor values) as follows:

dvf.f$factor_name

This allows the identifier for a factor to be accessed globally from within the Oracle database (using PL/SQL, SQL, Oracle Virtual Private Database, triggers, and so on). For example:

SQL> CONNECT macadmin/
Enter password: password    
SQL> SELECT dvf.f$database_ip FROM dual;
F$DATABASE_IP
-------------------------------------------------------------
172.16.0.3

You can also use the DVSYS.GET_FACTOR function to determine the identity of a factor that is made available for public access. For example:

SQL> SELECT get_factor('DATABASE_IP') FROM dual;
GET_FACTOR('DATABASE_IP')
-------------------------------------------------------------
172.16.0.3

Evaluation

Under Evaluation, select how you want the factor to be evaluated and assigned an identity. See "How Factors Affect Performance" for the performance effect of session factors. This attribute is mandatory.

The values are as follows:

Factor Labeling

Under Factor Labeling, select how you want the factor identity to retrieve an Oracle Label Security (OLS) label. This setting applies if you plan to use the Oracle Label Security integration. This attribute is mandatory if you want to use an OLS label. (See also "Integrating Oracle Database Vault with Oracle Label Security" for information on integrating OLS labels with a factors.

The values are as follows:

Retrieval Method

Under Retrieval Method, enter a PL/SQL expression that retrieves the identity of a factor or a constant. It can use up to 255 characters in mixed-case. The Retrieval Method identifies factors where the factor identification is by method or constant. If the factor identification is by factors, Oracle Database Vault identifies it by its identity mappings.

You can create your own PL/SQL retrieval methods, or use the functions supplied with Oracle Database Vault. See the following sections for factor-specific and general utility functions that you can use to build the retrieval method:

The following retrieval method sets a value of the Authentication_Method factor by retrieving the authentication method from the USERENV namespace in a user's session.

UPPER(SYS_CONTEXT('USERENV','AUTHENTICATION_METHOD'))

See also the default factors provided with Oracle Database Vault for examples of retrieval methods. "Default Factors" describes these factors.

The Retrieval Method field is mandatory if you have selected the following settings under Factor Identification:

The value returned as the factor identity must be a VARCHAR2 string or otherwise convertible to one.

You can include any package function or standalone function in the expression. Ensure that the expression is a fully qualified function, such as schema.function_name. Do not include complete SQL statements. If you are using application packages or functions, you must provide DVSYS with the GRANT EXECUTE privilege on the object.

Write the function signature using the following format:

FUNCTION get_factor RETURN VARCHAR2

Validation Method

Under Validation Method, enter a PL/SQL expression that returns a Boolean value (TRUE or FALSE) to validate the identity of a factor being retrieved (with the DVSYS.GET_FACTOR function) or the value to be assigned to a factor (with the DVSYS.SET_FACTOR function). If the method is evaluated to false for the value being retrieved or to be assigned, then the factor identity is set to null. This optional feature provides an additional level of assurance that the factor is properly retrieved and set. This field can have up to 255 characters in mixed-case.

You can include any package function or standalone function in the expression. Ensure that the expression is a fully qualified function, such as schema.function_name. Do not include complete SQL statements. If you are using application packages or functions, you must provide DVSYS with the GRANT EXECUTE privilege on the object.

Write the function using one of the following formats:

See the following sections for factor-specific and general utility functions that you can use to build the validation method:

Assignment Rule Set

Under Assignment Rule Set, select a rule set from the list if you want to use a rule set to control when and how a factor identity is set. For example, you can use a rule set to determine when a database session originates from a known application server or program. Chapter 6, "Configuring Rule Sets" explains how to create rule sets.

This attribute is particularly useful for situations where database applications, such as a Web application using a JDBC connection pool, must dynamically set a factor identity for the current database session. For example, a Web application may want to assign the geographic location for a database account logging in to the Web application. To do so, the Web application can use the JDBC Callable Statement, or Oracle Data Provider for .NET (ODP.NET) to execute the PL/SQL function DVSYS.SET_FACTOR, for example:

DVSYS.SET_FACTOR('GEO_STATE','VIRGINIA');

Then you can create an assignment rule for the GEO_STATE factor to allow or disallow the setting of the GEO_STATE factor based on other factors or rule repressions. See "How Factors Are Set" for more information.

Audit Options

Under Audit Options, select from the settings to generate a custom Oracle Database Vault audit record. You can use the Factor Audit Report to display the generated audit records. (See "Related Reports" for more information.) In addition, you can select multiple audit options at a time. Each option is converted to a bit mask and added to determine the aggregate behavior. Note that there is little performance impact in auditing, unless the factor has errors. This attribute is mandatory.

The values are as follows:

Conditions that you can select for the Always and Sometimes options are as follows:

Error Options

Under Error Options, select from the following to specify the processing that occurs when a factory identity cannot be resolved. This attribute is mandatory.

The values are as follows:

After you have created a new factor, you are ready to configure its identity. To do so, edit the factor and then add its identity.

4.3 Editing a Factor

To edit a factor:

  1. In the Oracle Database Vault Administration page, select Factors.

  2. In the Factors page, select the factor that you want to edit.

  3. Click Edit.

  4. Modify the factor as necessary, and then click OK.

See Also:

4.4 Adding an Identity to a Factor

After you create a new factor, you must add an identity to it. An identity is the actual value of the factor. For example, the identity of an IP_Address factor could be the IP address of 234.43.41.99.

A factor identity for a given database session is assigned at run time using the Factor Identification and Retrieval Method fields described in "Creating a Factor". Optionally, you can further configure the identity for the following reasons:

See "How Factors Work" for more information about how a factor behaves during a database session.

4.4.1 Creating and Configuring an Identity

To create and configure an identity:

  1. In the Oracle Database Vault Administration page, select Factors.

  2. In the Factors page, select the factor to which you want to add the identity.

  3. Click Edit.

  4. In the Edit Factor page, scroll down to Identities and click Create.

  5. In the Create Identity page, enter the following settings and then click OK:

General

Enter the following values:

  • Value: Enter the value of the identity, up to 1024 characters in mixed-case. This attribute is mandatory.

  • Trust Level: Select one of the following trust levels:

    • Very Trusted: Assigns a trust level value of 10

    • Trusted: Assigns a trust level value of 5

    • Somewhat Trusted: Assigns a trust level value of 1

    • Untrusted: Assigns a trust level value of -1

    • Trust Level Not Defined: Assigns a trust level value of NULL (default)

Trust levels enable you to assign a numeric value to indicate the measure of trust allowed. A trust value of 1 signifies some trust. A higher value indicates a higher level of trust. A negative value or zero indicates distrust. When the factor identity returned from a factor retrieval method is not defined in the identity, Oracle Database Vault automatically assigns the identity a negative trust level.

To determine the trust level of a factor identity at run time, you can use the GET_TRUST_LEVEL and GET_TRUST_LEVEL_FOR_IDENTITY functions in the DVSYS schema.

Example 4-1 shows examples of running these two functions.

Example 4-1 Determining the Trust Level of a Factor Identity

FUNCTION get_trust_level(p_factor IN VARCHAR2) RETURN NUMBER

FUNCTION get_trust_level_for_identity(p_factor IN VARCHAR2, p_identity IN VARCHAR2) RETURN NUMBER

For example, suppose you have created a factor named Network. You can create the following identities for the Network factor:

  • Intranet, with a trust level of 10

  • VPN (virtual private network), with a trust level of 5

  • Public, with a trust level of 1

You then can create rule expressions (or custom application code) that base policy decisions on the trust level. For example, you can use DVSYS.GET_TRUST_LEVEL to find trust levels greater than 5:

DVSYS.GET_TRUST_LEVEL('Network') > 5

Or, you can use a SELECT statement on the DVSYS.DBA_DV_IDENTITY table to find trust levels for the Network factor greater than 5:

SQL> SELECT factor_name,value, trust_level from dvsys.dba_dv_identity where trust_level >= 5 and factor_name='Network'

F$NETWORK GET_TRUST_LEVEL('NETWORK')
------------      -------------------
REMOTE                              5

In the preceding example, Network factor identity for REMOTE is trusted (value equals 5), and the identity for the INTRANET domain is 10, which implies a greater trust.

See Appendix D, "PL/SQL Interfaces to Oracle Database Vault" for more information about the Oracle Database Vault functions.

Label Security

You can assign Oracle Label Security (OLS) labels to factor identities. (In brief, a label acts as an identifier for a database table row to assign privileges to the row. For more information about labels, see Oracle Label Security Administrator's Guide.) The Factor Labeling attribute for a factor determines whether a factor is labeled By Self or By Factors. If you set the Factor Labeling attribute to By Self, then you can associate OLS labels with the factor identities. If you set the Factor Labeling attribute to By Factors, then Oracle Database Vault derives the factor identity labels from the labeling of child factor identities. When there are multiple child factor identities with labels, Oracle Database Vault merges the labels using the OLS algorithm associated with the applicable factor Oracle Label Security policy.

To label an identity:

  1. In the Create Identity page, under Label Identity, select the OLS label from the Available OLS Labels list.

    The list shows data labels from the Oracle Label Security installation for your site. For more information, refer to Oracle Label Security Administrator's Guide.

    Note:

    You can select multiple labels by holding down the Ctrl key as you click each label that is to be selected.
  2. Click Move to move the OLS label to the Selected OLS Labels list.

  3. Repeat Step 1 and Step 2 to select more OLS labels.

    You can select only one label per OLS policy.

  4. Click OK to finish labeling the identity.

Editing a Factor Identity

To edit a factor identity:

  1. In the Edit Factor page, scroll down to Identities and select the identity you want to edit.

  2. Click Edit.

  3. In the Edit Identity page, modify the identity as necessary.

  4. Click OK.

Deleting a Factor Identity

Before you delete a factor identity, you can locate the various references to it by querying the factor-related Oracle Database Vault views. See "Oracle Database Vault Public Views" for more information.

To delete a factor identity:

  1. In the Edit Factor page, scroll down to Identities and select the identity you want to remove.

  2. Click Remove.

  3. In the Confirmation page, click Yes.

4.4.2 Mapping Identities

Identity mapping is the process of identifying a factor by using other (child) factors. This is a way to transform combinations of factors into logical identities for a factor or to transform continuous identity values (for example, temperature) or large discrete identity values (for example, IP address ranges) into logical sets. To check configuration issues in the mapping for an identity, see "Identity Configuration Issues Report".

To map an identity to a factor:

  1. Create a parent factor and set the attribute Factor Identification to By Factors.

    "Creating a Factor" describes how to create factors.

  2. For the parent factor, create a new factor identity.

    "Creating and Configuring an Identity" describes how to create an identity.

  3. Map the factor-identity pair of the parent to the factor-identity pairs of its children. Use the following process:

    1. In the Factors page, select the parent factor from the Factors page and then click Edit.

    2. In the Edit Factor page, under Identities, select the parent factor identity and then click Edit.

    3. In the Edit Identity page, click Create under Map Identity.

    4. In the Create Identity Map page, select a factor name from the Contributing Factor box.

      This is the child factor to which you want to map the parent factor.

    5. Select a Map Condition.

      This setting lets you select an operator to compare the contributing (child) factor values.

    6. Enter a value for the Low Value and High Value (optional) fields.

      For example, consider a scenario where the Contributing Factor to the Factor Network is set to Client_IP, the Map Condition is set to Between, the Low Value is set to 192.168.0.1 and the High Value is set to 192.168.0.254. This means that whenever the client IP address lies in the specified address range of 192.168.0.1 to 192.168.0.254, the parent factor evaluates to a predefined identity, say, INTRANET.

    7. Click OK to map the parent factor-identity to the child factor-identity.

      You can map different identities of a parent factor to different identities of the contributing factor. For example, the INTRANET identity maps to an IP address range of 192.168.0.1 to 192.168.0.254. The REMOTE identity can map to an IP address range that excludes the address range 192.168.0.1 to 192.168.0.254.

      Based on identity mapping, you can create a security policy. For example, you can define a reduced set of privileges for an employee connecting over VPN (with REMOTE), as opposed to an employee connecting from within the corporate network (with INTRANET).

    8. Repeat Step c to Step g to add more contributing factors for a parent factor identity.

      For example, you can configure the Network factor to resolve to a value ACCOUNTING-SENSITIVE, when the Program factor resolves to "Oracle General Ledger" and the Client_IP is in between 192.168.0.1 and 192.168.0.254. So, if an authorized accounting financial application program, running on a client with IP address 192.168.0.23 accesses the database, then the Network factor is resolved to ACCOUNTING-SENSITIVE. A database session with the ACCOUNTING-SENSITIVE Network value would have more access privileges than one with the INTRANET Network value.

4.5 Deleting a Factor

Before you delete a factor, you can locate the various references to the factor and its identities by querying the factor-related Oracle Database Vault views. See "Oracle Database Vault Public Views" for more information.

To delete a factor:

  1. Delete any references to the factor, such as factor identities, and Oracle Label Security policy associations.

    You cannot delete a factor that has references.

  2. In the Oracle Database Vault Administration page, select Factors.

  3. In the Factors page, select the factor that you want to remove.

  4. Click Remove.

  5. In the Confirmation page, click Yes.

4.6 How Factors Work

The following topics in this section explain how Oracle Database Vault processes factors:

4.6.1 How Factors Are Processed When a Session Is Established

When a database session is established, the following actions occur:

  1. At the start of each database session, Oracle Database Vault begins to evaluate all default and user-created factors in the database instance.

    This evaluation occurs after the normal database authentication of the session and the initialization of the Oracle Label Security session information, if applicable.

  2. In the factor evaluation stage, the factor initialization process executes the retrieval method for all factors that are identified by methods or constants, to resolve the factor identity for the session.

    The factor error options setting has no effect on the factor initialization process.

  3. If a factor has a validation method defined, Oracle Database Vault validates the identity (value) of the factor by executing this validation method. If the validation method fails or returns false, the identity of the factor is undefined (NULL).

  4. If a factor has any identities defined for it, Oracle Database Vault resolves the trust level of the factor based on the identities defined. If an identity of the factor is defined in this list of defined identities, then Oracle Database Vault assigns the trust level as configured; otherwise it sets it to -1. If there are no identities defined for the factor, the trust level will be undefined (NULL).

  5. Depending on the outcome of this factor evaluation, factor validation, and trust level resolution, Database Vault audits the details of the evaluation as dictated by the factor audit configuration.

  6. When the evaluation of all factors that are identified by method or constant completes, Oracle Database Vault resolves the factors that are identified by other factors by using the identity maps that are defined for the factor configured identities.

    The evaluation order of the factor-configured identities is by ASCII sort on the identity values: Oracle Database Vault uses the first alphabetically sorted identity mapping that it evaluates. For example, suppose factor TEST has identities X and Y. Furthermore, identities X and Y have identity maps that are dependent on identities for factors A, B, and C. The following mapping occurs:

    • X is mapped when A=1 and B=1

    • Y is mapped when A=1, B=1, and C=2

    In this case, the first one evaluated is X. Y is not evaluated, but what if its C mapping meets the criteria that is needed for the TEST factor's success? You would need to reverse the mapping, that is, map Y before X so that A, B, and C can be evaluated first. To reverse the mapping, rename Y to V (or some alphabetic value that sorts before X) so that it can be correctly resolved.

    This algorithm works if the ASCII sort ordering is correct and the identities map the same number factors at some level.

  7. When the factor initialization completes, the Oracle Database Vault integration with Oracle Label Security occurs.

After this process completes, Oracle Database Vault checks to see if a command rule is associated with the CONNECT event. If a rule set associated with the CONNECT event, then Oracle Database Vault evaluates the rule set. If the rule set evaluates to false or results in an error, the session is terminated. Oracle Database Vault executes any auditing or call handlers associated with the rule set before the session is terminated (or not, if the rule set is always audited).

Note:

Be careful about associating command rules with the CONNECT event, because you can inadvertently lock out other users from of the database. If this happens, do the following:
  1. Disable Oracle Database Vault.

    Appendix B explains how to disable and reenable Oracle Database Vault.

  2. Delete the CONNECT command rules by using the Oracle Database Vault DVSYS.DBMS_MACADM.DELETE_COMMAND_RULE procedure, for example:

    EXECUTE DBMS_MACADM.DELETE_COMMAND_RULE('CONNECT', '%', '%');
    

    (You still can make Oracle Database Vault API calls when Oracle Database Vault has been disabled.)

  3. Reenable Oracle Database Vault.

4.6.2 How Factors Are Retrieved

You can retrieve a factor in a database session at any time by using the DVF factor function or the DVSYS.GET_FACTOR function.

Example 4-2 shows an example of using the DVSYS.GET_FACTOR function.

Example 4-2 Using DVSYS.GET_FACTOR to Retrieve a Factor

SQL> SELECT get_factor('client_ip') FROM DUAL;

You can use the factor values retrieved from the DVF factor function or the DVSYS.GET_FACTOR in the following ways:

  • Oracle Database Vault rule expressions

  • Custom application code that is available to all database sessions in an Oracle Database Vault environment

"Oracle Database Vault PL/SQL Factor Functions" describes DVF factor functions in detail.

If you had set the factor evaluation to By Session, then Oracle Database Vault retrieves the value from the session context established, as described under "How Factors Are Processed When a Session Is Established".

If you had set the factor evaluation to By Access, then Oracle Database Vault performs Step 2 through Step 5 (or Step 6), as described under "How Factors Are Processed When a Session Is Established", whenever the factor is retrieved.

If you had defined error options for the factor and if an error occurs, then Oracle Database Vault displays the error message.

4.6.3 How Factors Are Set

You can have a factor identity assigned at any time during a database session, but only if you have defined a factor assignment rule set and that rule set evaluates to true. You can do this in the application code by using the DVSYS.SET_FACTOR function. In Java code, you can use the JDBC class java.sql.CallableStatement to set this value. For example:

java.sql.Connection connection ; 
...
java.sql.CallableStatement statement = 
   connection.prepareCall("{call DVSYS.SET_FACTOR('FACTOR_X', ?)}");
statement.setString(1, "MyValue");
boolean result = statement.execute();
...

Applications that can execute Oracle PL/SQL functions can use this procedure, for example, applications written using Oracle Data Provider for .NET (ODP.NET).

This concept is similar to the standard Oracle DBMS_SESSION.SET_IDENTIFIER procedure with an added feature that a rule set controls when a factor value can be set. If the rule set evaluates to true, Steps 2 through 5 under "How Factors Are Processed When a Session Is Established" occur.

If you have not associated a assignment rule set for the factor or if the rule set returns false (or returns errors), then Oracle Database Vault sends an error message if you attempt to set the factor using the DVSYS.SET_FACTOR function.

4.7 Example of How Factors Work

Oracle Database Vault provides a set of default factors that can be used for routine tasks such as finding host names, IP addresses, names of database instances, and names of session users (See "Default Factors".) However, you can create custom factors if you want. For example, you can create a Program factor that returns the name of the program that is running in the current session. To create this factor, the security administrator used the following settings:

When the Program factor was created, it was immediately available for use in database sessions and applications using standard Oracle SQL and PL/SQL expressions. You can query this factor by using standard SQL or by using it in PL/SQL expressions, because it has been exposed as an Oracle function to all database sessions.

Example 4-3 shows how to query the current value of the Program factor using an account with the DV_OWNER role

Example 4-3 Using GET_SESSION_INFO to Query the Value of a Factor

sqlplus macsys
Enter password: password
SQL> SELECT DVSYS.DBMS_MACADM.GET_SESSION_INFO('PROGRAM') FROM dual;
F$PROGRAM
---------------------
sqlplus@stadb38 (TNS V1-V3)

This example showed how a fairly simple factor works. For a more complex example on how to integrate an Oracle Database Vault factor with an Oracle Label Security label, see "Example of Integrating Oracle Database Vault with Oracle Label Security".

4.8 Default Factors

Oracle Database Vault provides a set of default factors. You can create custom factors based on these default factors using your own PL/SQL retrieval methods. See "Oracle Database Vault PL/SQL Factor Functions" for a listing of the PL/SQL functions for these factors.

You can use the default factors in your own security configurations. If you do not need them, you can remove them. (That is, they are not needed for internal use by Oracle Database Vault.)

4.9 Guidelines for Designing Factors

Follow these guidelines for designing factors:

4.10 How Factors Affect Performance

Each factor has elements that are processed, such as its validation method, trust level, and so on. For factors that are evaluated by the session, such as Database_Hostname and Proxy_User, Oracle Database Vault performs this processing during session initialization, and then caches the results for subsequent requests for that value.

The 17 default factors listed in "Default Factors" are cached because they are likely candidates for a typical security policy. However, if you only use five factors, for example, in rule sets or other components, the other factors consume resources that could otherwise be used elsewhere. In this case, you should remove the uneccessary factors by deleting them. (Oracle Database Vault does not use any of these factors internally, so you can remove them if you do not need them.)

If you have a large number of users or if your application server frequently must create and destroy connections, the resources used can affect system performance. You can delete the unnecessary factors.

You can check system performance by running tools such as Oracle Enterprise Manager (including Oracle Enterprise Manager Database Control, which is installed by default with Oracle Database), Statspack, and TKPROF. For more information about Oracle Enterprise Manager, see the Oracle Enterprise Manager documentation set. For information about Database Control, refer to its online Help. Oracle Database Performance Tuning Guide describes the Statspack and TKPROF utilities.

4.11 Related Reports

Table 4-1 lists Oracle Database Vault reports that are useful for analyzing factors and their identities. See Chapter 9, "Generating Oracle Database Vault Reports" for information about how to run these reports.

Table 4-1 Reports Related to Factors and Their Identities

Report Purpose

"Factor Audit Report"


To audit factors, for example, to find factors that failed to be evaluated

"Factor Configuration Issues Report"


To find configuration issues, such as disabled or incomplete rule sets, or to audit issues that may affect the factor

"Factor Without Identities Report"


To find factors that have had no identities assigned yet

"Identity Configuration Issues Report"


To find factors that have invalid label identities or no map for the identity

"Rule Set Configuration Issues Report"


To find rule sets that have no rules defined or enabled, which may affect the factors that use them