CreateFunctionalUsersForUnassignedAccounts

Perform Execution of the Consistency Rule CreateFunctionalUsersForUnassignedAccounts in Identity Store

CreateFunctionalUsersForUnassignedAccounts executes the consistency rule of the same name over all accounts in the Identity Store that have no associated functional user. For each qualifying account the PolicyAgent creates a functional user entry and links it to the account, ensuring that every functional account in the Identity Store is represented by a proper identity object.

Run this workflow during initial configuration after importing accounts, or periodically as a remediation step when new unassigned functional accounts are discovered.

The workflows in this reference are delivered as factory data and are loaded into the Connectivity configuration database during the initial configuration. They are samples: use the Identity Manager to copy a workflow into your own scenario and adapt the copy. Do not change the delivered objects, because a product update can replace them.

At a Glance

Name

CreateFunctionalUsersForUnassignedAccounts

Prerequisites

The CreateFunctionalUsersForUnassignedAccounts consistency rule must be configured in the Identity Store.
The FunctionalUsersForUnassignedAccounts in and FunctionalUsersForUnassignedAccounts out channels must be configured in the C++-based Server.

Workflow and Activities

Step Activity Description Agent Runs after

Step	Activity	Description	Agent	Runs after
1	`FunctionalUserForUnassignedAccount`	Policy execution via DirX Identity Policy agent	`PolicyAgent`	start activity

FunctionalUserForUnassignedAccount

Policy execution via DirX Identity Policy agent

PolicyAgent

start activity

Jobs and Agents

Activity Job Agent Operation Input channel Output channel

Activity	Job	Agent	Operation	Input channel	Output channel
`FunctionalUserForUnassignedAccount`	`FunctionalUsersForUnassignedAccounts`	`PolicyAgent`	Full Import	`FunctionalUsersForUnassignedAccounts in`	`FunctionalUsersForUnassignedAccounts out`

FunctionalUserForUnassignedAccount

FunctionalUsersForUnassignedAccounts

PolicyAgent

Full Import

FunctionalUsersForUnassignedAccounts in

FunctionalUsersForUnassignedAccounts out

Configuration Parameters

Table 1. Parameters of job `FunctionalUsersForUnassignedAccounts`
Parameter	Default value
`delta_mode`	full
`delta_on`	0
`mode`	AssignOnly
`request`	process
`trace`	9

A Tcl-based workflow runs scheduled in the C++-based Server (IdS-C). Its activities run in the order defined by the dxmPredecessorActivity-DN chain, and each activity starts a job that runs one agent with one input and one output channel. Agents exchange their data through files or directly through the meta controller, so a typical workflow consists of an export activity that writes the data of the connected system and an import activity that maps and loads that data into the Identity Store.

You start these workflows manually from the Identity Manager or attach them to a schedule.

The workflow has a single activity, FunctionalUserForUnassignedAccount, which runs the PolicyAgent job FunctionalUsersForUnassignedAccounts. The job reads entries from the FunctionalUsersForUnassignedAccounts in input channel (which selects accounts without a linked functional user) and writes the created functional user entries to the FunctionalUsersForUnassignedAccounts out output channel. The mode is AssignOnly and the request is process.

Operation

You start the workflow manually from the Identity Manager or attach it to a schedule.
The C++-based Server starts the FunctionalUserForUnassignedAccount activity and launches the PolicyAgent job.
The agent reads accounts from the Identity Store through the FunctionalUsersForUnassignedAccounts in input channel; the channel filter selects accounts that have no associated functional user.
For each matching account the consistency rule creates a functional user entry and writes the link back to the Identity Store.
The results are written through the FunctionalUsersForUnassignedAccounts out output channel.