CreateUsersForUnassignedAccounts

Perform Execution of the Consistency Rule CreateUsersForUnassignedAccounts in Identity Store

CreateUsersForUnassignedAccounts executes the consistency rule of the same name over all accounts in the Identity Store that have no owning user. For each qualifying account the PolicyAgent creates a user entry and links the account to it, so that every account in the Identity Store is associated with a user identity.

Run this workflow during initial configuration after importing accounts, or periodically to remediate any accounts that were created outside the normal provisioning path and therefore have no owning user.

The workflows in this reference are delivered as factory data and are loaded into the Connectivity configuration database during the initial configuration. They are samples: use the Identity Manager to copy a workflow into your own scenario and adapt the copy. Do not change the delivered objects, because a product update can replace them.

At a Glance

Name

CreateUsersForUnassignedAccounts

Prerequisites

The CreateUsersForUnassignedAccounts consistency rule must be configured in the Identity Store.
The UsersForUnassignedAccounts in and UsersForUnassignedAccounts out channels must be configured in the C++-based Server.

Workflow and Activities

Step Activity Description Agent Runs after

Step	Activity	Description	Agent	Runs after
1	`UserForUnassignedAccount`	Policy execution via DirX Identity Policy agent	`PolicyAgent`	start activity

UserForUnassignedAccount

Policy execution via DirX Identity Policy agent

PolicyAgent

start activity

Jobs and Agents

Activity Job Agent Operation Input channel Output channel

Activity	Job	Agent	Operation	Input channel	Output channel
`UserForUnassignedAccount`	`UsersForUnassignedAccounts`	`PolicyAgent`	Full Import	`UsersForUnassignedAccounts in`	`UsersForUnassignedAccounts out`

UserForUnassignedAccount

UsersForUnassignedAccounts

PolicyAgent

Full Import

UsersForUnassignedAccounts in

UsersForUnassignedAccounts out

Configuration Parameters

Table 1. Parameters of job `UsersForUnassignedAccounts`
Parameter	Default value
`delta_mode`	full
`delta_on`	0
`mode`	AssignOnly
`request`	process
`trace`	9

A Tcl-based workflow runs scheduled in the C++-based Server (IdS-C). Its activities run in the order defined by the dxmPredecessorActivity-DN chain, and each activity starts a job that runs one agent with one input and one output channel. Agents exchange their data through files or directly through the meta controller, so a typical workflow consists of an export activity that writes the data of the connected system and an import activity that maps and loads that data into the Identity Store.

You start these workflows manually from the Identity Manager or attach them to a schedule.

The workflow has a single activity, UserForUnassignedAccount, which runs the PolicyAgent job UsersForUnassignedAccounts. The job reads accounts without an owning user from the UsersForUnassignedAccounts in input channel and writes the created user entries to the UsersForUnassignedAccounts out output channel. The mode is AssignOnly and the request is process.

Operation

You start the workflow manually from the Identity Manager or attach it to a schedule.
The C++-based Server starts the UserForUnassignedAccount activity and launches the PolicyAgent job.
The agent reads accounts from the Identity Store through the UsersForUnassignedAccounts in input channel; the channel filter selects accounts that have no owning user entry.
For each matching account the consistency rule creates a user entry and links the account to it.
The results are written through the UsersForUnassignedAccounts out output channel.