Creating Entitlements
23
no
vd
ocx
(e
n)
13
Ma
y 20
09
or
Select
No
if the entitlement can only be granted once, then click
Next
.
For example, you might only want to use an entitlement one time to assign a building location
to a user. However, because a user could belong to multiple groups, you might want an
entitlement that assigns a user to a group to be able to be used multiple times to assign the user
to multiple groups.
5
You are asked if this entitlement is intended to be used by Role-Based Entitlement policies
through iManager. If you want this entitlement to be granted or revoked automatically, select
Yes
to the Role-Based Entitlements question, click
Next
, then continue with Step 11.
or
If you want the granting or revoking of this entitlement to be a manual process (approved by
someone), select
No
to use the User Application, then skip to
Step 7
.
6
(Conditional) If you select
Yes
to the Role-Based Entitlements question, you are asked if you
want to use the Role-Based Entitlements priority to resolve any conflicts that might happen
when this entitlement is assigned more than once with different values. You can resolve the
conflict by either using Role-Based Entitlements priority, or by merging the values.
Merging the values merges the entitlements of all involved Role-Based Entitlement policies, so
if one policy revokes an entitlement but another policy grants an entitlement, the entitlement is
eventually granted. Solving conflicts by priority works if you need to ensure that only one
policy is applied to this entitlement at any time. This example uses priority.
7
Click
Finish
.
In the example shown in
Step 2
, the query values look for the Source Distinguished Name
attribute of the Class name of Group, starting from the Base DN (Blanston) and checking
through the subtree from that beginning point. The values that come back from the query are
similar to the following:
<instance class-name="Group" src-dn="o=Blanston,cn=group1">
<association>o=Blanston,cn=group1</association>
<attr attr-name="Description"> the description for group1</attr>
</instance>
<instance class-name="Group" src-dn="o=Blanston,cn=group2">
<association>o=Blanston,cn=group2</association>
<attr attr-name="Description"> the description for group2</attr>
</instance>
<instance class-name="Group" src-dn="o=Blanston,cn=group3">
<association>o=Blanston, cn=group3</association>
<attr attr-name="Description"> the description for group3</attr>
</instance>
<!-- ... ->
The information received from the query fills in the various fields. For instance, the
<
display-name
> field receives o=Blanston,cn=group1. The <
description
> field receives
the description for Group1, and the <
ent-value
> field receives o=Blanston,cn=group1.
Because more than one group exists and meets the query criteria, this information is also
collected and shown as other instances of the query.
The association format value is unique for every external system, so the format and syntax are
different for each external system queried.
Summary of Contents for IDENTITY MANAGER 3.6.1 - ENTITLEMENTS
Page 4: ...4 Identity Manager 3 6 1 Entitlements Guide novdocx en 13 May 2009...
Page 6: ...6 Identity Manager 3 6 1 Entitlements Guide novdocx en 13 May 2009...
Page 8: ...8 Identity Manager 3 6 1 Entitlements Guide novdocx en 13 May 2009...
Page 12: ...12 Identity Manager 3 6 1 Entitlements Guide novdocx en 13 May 2009...
Page 26: ...26 Identity Manager 3 6 1 Entitlements Guide novdocx en 13 May 2009...
Page 44: ...44 Identity Manager 3 6 1 Entitlements Guide novdocx en 13 May 2009...
