Novell IDENTITY MANAGER 3.6.1 - ENTITLEMENTS, Manual

Page: 40 / 44

40 Identity Manager 3.6.1 Entitlements Guide
no
vd
ocx
(e
n)
13
Ma
y 20
09
This is an Account Entitlement , and the display name is Account Entitlement. This information is all
you need to create an Account Entitlement, which you can then use to grant an account in an
application.
The Active Directory driver with entitlements enabled has a UserAccount entitlement that Active
Directory uses to grant or revoke a user account.
<?xml version="1.0" encoding="UTF-8"?>
<entitlement conflict-resolution="union"
description="The User Account entitlement grants or denies an
account in Active Directory for the user. When granted, the user
is given an enabled logon account. When revoked, the logon
account is either disabled or deleted depending on how the drive
is configured."
display-name="User Account Entitlement" name="UserAccount">
</entitlement>
In this example, the conflict resolution is Union, which allows the entitlement to merge the values
that are assigned. (Again, valued settings don’t apply to valueless entitlements.) The
Description
field explains what this entitlement is used for and why it was created. This is useful information for
those who perform future modifications to the entitlement. The actual name of the entitlement is
UserAccount, while the
<display-name>
displays in a managing agent as User Account
Entitlement.
A.2.2 Example 2: Application Query Entitlement: External
Query
The Group and Exchange Mailbox entitlements that come with an entitlement-enabled Active
Directory driver offer examples of application queries. Use this entitlement type when you need
external information from a connected system to perform an event.
<?xml version="1.0" encoding="UTF-8"?>
<entitlement conflict-resolution="union"
description="The Group Entitlement grants or denies membership in
a group in Active Directory. The group must be associated with a
group in the Identity Vault. When revoked, the user is removed from
the group. The group membership entitlement is not enforced on the
publisher channel: If a user is added to a controlled group in
Active Directory by some external tool, the user is not removed by
the driver. Further, if the entitlement is removed from the user
object instead of being simply revoked, the driver takes no action."
display-name="Group Membership Entitlement" name="Group">
<values>
<query-app>
<query-xml>
<nds dtd-version="2.0">
<input>
<query class-name="Group"
scope="subtree">
<search-class class-name="Group"/>
<read-attr attr-name="Description"/>
</query>
</input>
</nds>
</query-xml>
<result-set>