Novell IDENTITY MANAGER ENTITLEMENTS SERVICE DRIVER 3.6.1, Руководство по внедрению

Страница: 10 / 40

10 Identity Manager 3.6.1 Driver for Role-Based Entitlements: Implementation Guide
no
vd
ocx
(e
n)
17
Sep
te
m
be
r 20
09
Figure 1-1
Entitlements Service Driver Process
The driver implements entitlements through the use of entitlement policies. An entitlement policy
contains the following:
Š
Membership: The list of users assigned to a policy. A user can be dynamically assigned to a
policy when he or she meets the criteria for the policy, or the user can be statically (manually)
assigned to the policy. In the above example, User A, User B, and User C are all members of
Entitlement Policy 1. User D and User E are members of Entitlement Policy 2.
Š Entitlements: The list of entitlements associated with the policy. Users assigned to the policy
receive all of the entitlements associated with the policy. If the user is removed from the policy,
he or she loses all entitlements associated with the policy. In the above example, the
Entitlements Service driver has granted the AD User Account entitlement and GroupWise
®
Mailbox entitlement to User A, User B, and User C. Likewise, the driver has granted the AD
User Account entitlement and Exchange Mailbox entitlement to User D and User E.
The Entitlements Service driver uses the following basic process to grant entitlements to and revoke
entitlements from users:
1. The driver evaluates the users within its defined scope to see if they meet the criteria
established for membership in a policy. This occurs whenever:
Š
Any criteria attribute used for determining membership in an entitlement policy is
modified.
Š A user is moved.