Novell IDENTITY MANAGER 3.6.1 - ENTITLEMENTS, Manual

Page: 42 / 44

42 Identity Manager 3.6.1 Entitlements Guide
no
vd
ocx
(e
n)
13
Ma
y 20
09
<?xml version="1.0" encoding="UTF-8"?>
<entitlement conflict-resolution="union"
description="The Exchange Mailbox Entitlement grants or denies an
Exchange mailbox for the user in Microsoft Exchange."
display-name="Exchange Mailbox Entitlement" name="ExchangeMailbox">
<values>
<query-app>
<query-xml>
<nds dtd-version="2.0">
<input>
<query class-name="msExchPrivateMDB"
dest-dn="CN=Configuration," scope="subtree">
<search-class class-name="msExchPrivateMDB"/>
<read-attr attr-name="Description"/>
<read-attr attr-name="CN"/>
</query>
</input>
</nds>
</query-xml>
<result-set>
<display-name>
<token-attr attr-name="CN"/>
</display-name>
<description>
<token-attr attr-name="Description"/>
</description>
<ent-value>
<token-src-dn/>
</ent-value>
</result-set>
</query-app>
</values>
</entitlement>
In this example, the Exchange Mailbox entitlement uses Union to settle conflicts if the entitlement is
applied more than once to the same object. The Union attribute merges the entitlements of all
involved Role-Based Entitlement policies, so if one policy revokes an entitlement but another policy
grants an entitlement, the entitlement is eventually granted.
The description states that the entitlement grants or revokes an Exchange mailbox for the user in
Microsoft* Exchange, which is enough detail for what the entitlement does. The display name is
Exchange Mailbox Entitlement, which appears in the managing agents, such as iManager for Role-
Based Entitlements. The name is the Relative Distinguished Name (RDN) of the entitlement. If you
don’t define a display name, the entitlement’s name is its RDN.
The initial query values look for the class name of msExchPrivateMDB, which is a Microsoft
Exchange function call that begins looking in container Configuration and continues through its
subtrees. These values come from the connected Active Directory database and the application
query starts at the
<nds>
tag. The class msExchPrivateMDB has no equivalent in eDirectory, so you
need to be conversant in Microsoft Exchange function calls to make such a query. But the query is
completed because of the rules and policies that are found in the Active Directory driver.
Entitlement consumers use the information that is retrieved by the query. For example, the
entitlement value (
ent-value
) is passed to Identity Manager policies through the DirXML-
EntitlementRef attribute. The display name and description information are displayed by iManager
or the User Application and are stored in the DirXML-SPCachedQuery attribute.