Certification reporting

There are three types of certification reports presented in OpenIAM.

Scope report

The purpose of this report is to show the initial state of the certification. It lists the users whose access will be reviewed, what access will be reviewed, and who will do the review. This report is generated by the system in the background when the administrator initiates a new campaign. The report can be downloaded in the webconsole, on the Report tab of the certification screen. Also, the campaign managers of the campaign can find this report in self-service, in the Report tab. The admin can perform an EXECUTE_ACCESS_CERTIFICATION command to see if there are any warning messages about scope report generation.

Current state report

The purpose of this report is to represent the current status of an access certification. The administrator can generate it, and it will be delivered to their mailbox. The report contains information about the certification status at the time of generation. This function is equivalent to getting a report from the Report menu > ACCESS_CERTIFICATION_REPORT.

Results report

The purpose of this report is to represent the results of a completed access certification campaign. This report is generated by the system: the batch task Access Certification reporting runs every night (and can be reconfigured to run on a custom schedule) and checks if there is a completed certification campaign without a results report. If the campaign lacks the results report, then the report is generated and sent to each campaign manager's email. This process is captured in the audit system, and you can run it with the ACCESS_CERTIFICATION_AUTO_REPORTING action.

The BULK_APPROVAL_RISK column

The Results report includes a BULK_APPROVAL_RISK column that flags how each item's decision was made. This lets auditors identify access that was certified in bulk rather than reviewed one item at a time.

This column is populated regardless of whether bulk approval was enabled for the campaign; when the setting is disabled, every item shows No. For details on the optional setting that makes bulk decisions possible, see Allow bulk approval.

Scalable report generation

Regardless of type, every certification report is generated in a way that scales to very large campaigns and spreads the work across the cluster, so that even campaigns with hundreds of thousands of access-review items do not exhaust memory or tie up a single node.

When a report is requested, certification-manager divides the campaign's access-review items into fixed-size pages and hands each page out as a separate unit of work. Any certification-manager node in the cluster can pick up a page, build just that page's rows, and write them to a temporary part file on the shared report volume. Because each node only ever holds one page in memory at a time — instead of the whole campaign — memory usage stays bounded no matter how big the campaign is, and the pages are processed in parallel across however many nodes are running. When the last page is finished, the node that completes it stitches the parts together into the final CSV, publishes it, and emails it to the recipients exactly as before. A single bad record never aborts the whole report: the offending row is replaced with an error marker and generation continues.

This behavior is automatic and requires no configuration. Administrators running large deployments can optionally tune how aggressively each node consumes report pages with the following properties:

certification-manager