Novell IDENTITY MANAGER 3.6.1 - ENTITLEMENTS, Manual

Page: 37 / 44

Writing Entitlements in XML 37
no
vd
ocx
(e
n)
13
Ma
y 20
09
<!--
Entitlement definition stored in the XmlData attribute of a
DirXML-Entitlement object.
-->
Headings are followed by Elements (
ELEMENT
) and Attribute lists (
ATTLIST
). Below is a detailed
explanation of the elements and attributes under the Entitlement Definition heading, which is the
main heading you need to focus on when creating entitlements.
<!ELEMENT entitlement (values?)>
The root level element is
<entitlement>
, which can contain a single, optional, child
<values>
element. This is followed by the Attribute list, which includes
conflict-resolution
,
display-
name
, and
description
. Conflict resolution uses Priority or Union attribute values.
conflict-resolution (priority | union) "priority"
Role-Based Entitlements use conflict resolution to determine what should happen when a valued
entitlement is applied multiple times to the same object. For example, suppose that user U is a
member of Entitlement Policy A and Entitlement Policy B, each of which reference the same valued
entitlement E, but with a different set of values. Entitlement E of Entitlement Policy A has values (a,
b, c). Entitlement E of Entitlement Policy B has a set of values (c, d, e).
The conflict resolution attribute decides which set of values should apply to user U. If the attribute is
set to union, user U is assigned both sets of values (a, b, c, d, e). If it is set to priority, user U would
get only one set of values, depending upon which Entitlement Policy has a higher priority.
If an entitlement is single-valued, conflicts must be resolved by priority, because a union of values
results in more than one value being applied. Role-Based Entitlements presently uses this attribute;
in the future, Workflow Entitlements might also use it.
display-name CDATA #REQUIRED
description CDATA #REQUIRED
The literal entitlement name is not necessarily what an entitlement should display. The Display-
name and Description attributes are intended for end-user display. (In Designer, you have an option
to choose a display name for the entitlement instead of using the actual entitlement name.)
<!ELEMENT values (query-app | value+)?>
<!ATTLIST values
multi-valued (true | false) "true"
The
<values>
element is optional and indicates that an entitlement is valued. If you do not use this
element, it means an entitlement is valueless. An example of a valued entitlement is an entitlement
that grants a distribution list. An example of a valueless entitlement is an entitlement that grants an
account in an application, such as the User Account entitlement that comes with the Active
Directory driver.
Valued entitlements receive their values from three sources. One source is the external application
(designated by the
<query-app>
element). Another is from a predefined list of enumerated values
(one or more
<value>
elements). The third source is from the entitlement client (a
<values>
element with no
<value>
children). The examples are helpful in explaining the way values work.
Valued entitlements may be single-valued or multi-valued, and the default is multi-valued. It is the
responsibility of the entitlement client to enforce this restriction.