CampaignGeneration

Starts a certification campaign

CampaignGeneration scans the Identity Store for groups, permissions and roles that are due for certification and starts a certification campaign for each. It evaluates the groups_filter, permissions_filter and roles_filter parameters to identify entries whose certification date has been reached and whose campaign is not yet pending, and then uses the CampaignGeneratorAgent to create the corresponding campaign objects.

Run this workflow on a schedule so that certification campaigns are created automatically when entries become due, or trigger it manually to start a certification cycle at any time.

The workflows in this reference are delivered as factory data and are loaded into the Connectivity configuration database during the initial configuration. They are samples: use the Identity Manager to copy a workflow into your own scenario and adapt the copy. Do not change the delivered objects, because a product update can replace them.

At a Glance

Name

CampaignGeneration

Category

Identity Store

Technology

Tcl-based scheduled workflow

LDAP object class

dxmWorkflow

Workflow type

-

Connected system / controller type

-

Configuration wizard

LDAP-LDAP

Active in the factory data

not set

Factory data version

8.1

Factory data path

Workflows/Default/Identity Store/CampaignGeneration

Prerequisites

  • The DirX Identity certification feature must be configured in the domain.

  • Groups, permissions or roles must have dxrNeedsCertification set to true and a dxrCertificationDate value so that the workflow’s filters can match them.

  • The CampaignGeneratorAgent must be deployed in the C++-based Server.

Workflow and Activities

Step Activity Description Agent Runs after

1

CampaignGeneration

Starts certification campaigns

CampaignGeneratorAgent

start activity

Jobs and Agents

Activity Job Agent Operation Input channel Output channel

CampaignGeneration

CampaignGeneration

CampaignGeneratorAgent

Full Import

Default

Default

Configuration Parameters

Table 1. Parameters of job CampaignGeneration
Parameter Default value

delta_mode

full

delta_on

0

groups_certification_period

P0Y0M0DT0H0M0S

groups_filter

(&(objectClass=dxrTargetSystemGroup)(dxrNeedsCertification=true)(|(dxrCertificationPending=FALSE)(!(dxrCertificationPending=)))(|(!(dxrState=DELETED))(!(dxrState=)))(dxrCertificationDate ⇐$\28gmtime\29))

groups_pagesize

10

groups_user_pagesize

100

permissions_certification_period

P0Y0M0DT0H0M0S

permissions_filter

(&(objectClass=dxrPermission)(dxrNeedsCertification=true)(|(dxrCertificationPending=FALSE)(!(dxrCertificationPending=)))(|(!(dxrState=DELETED))(!(dxrState=)))(dxrCertificationDate ⇐$\28gmtime\29))

permissions_pagesize

10

permissions_user_pagesize

100

process_roles

FALSE

process_roles_indirect

FALSE

roles_certification_period

P0Y0M0DT0H0M0S

roles_filter

(&(objectClass=dxrRole)(dxrNeedsCertification=true)(|(dxrCertificationPending=FALSE)(!(dxrCertificationPending=)))(|(!(dxrState=DELETED))(!(dxrState=)))(dxrCertificationDate ⇐$\28gmtime\29))

roles_pagesize

10

roles_user_pagesize

100

trace

2

users_limit

100

A Tcl-based workflow runs scheduled in the C++-based Server (IdS-C). Its activities run in the order defined by the dxmPredecessorActivity-DN chain, and each activity starts a job that runs one agent with one input and one output channel. Agents exchange their data through files or directly through the meta controller, so a typical workflow consists of an export activity that writes the data of the connected system and an import activity that maps and loads that data into the Identity Store.

You start these workflows manually from the Identity Manager or attach them to a schedule.

The workflow has a single activity, CampaignGeneration, which runs the CampaignGeneratorAgent job. The job reads entries that match the configured filters from the Default input channel and writes the generated campaign objects back through the Default output channel. The users_limit parameter caps the number of users per campaign object, and the separate *_pagesize and *_user_pagesize parameters control how many items are read in each batch.

Operation

  1. You start the workflow manually from the Identity Manager or attach it to a schedule.

  2. The C++-based Server starts the CampaignGeneration activity and launches the CampaignGeneratorAgent job.

  3. The agent reads groups, permissions and roles from the Identity Store that match the respective LDAP filters and whose dxrCertificationDate is at or before the current time.

  4. For each matching entry the agent creates a certification campaign object in the Identity Store, limited to users_limit users per campaign.

  5. Entries for which dxrCertificationPending is already TRUE or whose state is DELETED are skipped by the filters.

  6. After the run the new campaign objects are visible in the Identity Manager and available for the reviewers' approval workflow.