PolicyExecution

Perform Execution of policies in Identity Store

PolicyExecution runs the Identity Store policy agent over the entire domain and applies all configured policies to the entries that match each policy’s filter. Typical policies handle tasks such as attribute derivation, naming convention enforcement, or custom assignment rules. Use this workflow on a schedule or on demand whenever you want to apply or re-evaluate all policies in the Identity Store.

The workflows in this reference are delivered as factory data and are loaded into the Connectivity configuration database during the initial configuration. They are samples: use the Identity Manager to copy a workflow into your own scenario and adapt the copy. Do not change the delivered objects, because a product update can replace them.

At a Glance

Name

PolicyExecution

Category

Identity Store

Technology

Tcl-based scheduled workflow

LDAP object class

dxmWorkflow

Workflow type

-

Connected system / controller type

-

Configuration wizard

LDAP-LDAP

Active in the factory data

not set

Factory data version

7.0

Factory data path

Workflows/Default/Identity Store/PolicyExecution

Prerequisites

  • Policies must be configured in the Identity Store domain.

  • The PolicyExecution in and PolicyExecution out channels must be configured in the C++-based Server.

Workflow and Activities

Step Activity Description Agent Runs after

1

PolicyExecution

Policy execution via DirX Identity Policy agent

PolicyAgent

start activity

Jobs and Agents

Activity Job Agent Operation Input channel Output channel

PolicyExecution

PolicyExecution

PolicyAgent

Full Import

PolicyExecution in

PolicyExecution out

Configuration Parameters

Table 1. Parameters of job PolicyExecution
Parameter Default value

delta_mode

full

delta_on

0

mode

AssignOnly

request

process

trace

2

A Tcl-based workflow runs scheduled in the C++-based Server (IdS-C). Its activities run in the order defined by the dxmPredecessorActivity-DN chain, and each activity starts a job that runs one agent with one input and one output channel. Agents exchange their data through files or directly through the meta controller, so a typical workflow consists of an export activity that writes the data of the connected system and an import activity that maps and loads that data into the Identity Store.

You start these workflows manually from the Identity Manager or attach them to a schedule.

The workflow has a single activity, PolicyExecution, which runs the PolicyAgent job of the same name. The job reads entries from the PolicyExecution in input channel, evaluates the matching policies for each entry, and writes the updated entries to the PolicyExecution out output channel. The mode is AssignOnly and the request is process.

Operation

  1. You start the workflow manually from the Identity Manager, attach it to a schedule, or trigger it as part of the CombinedMaintenance workflow.

  2. The C++-based Server starts the PolicyExecution activity and launches the PolicyAgent job.

  3. The agent reads entries from the Identity Store through the PolicyExecution in input channel and evaluates the configured policies for each entry.

  4. Policy actions — such as setting or updating attributes — are applied to matching entries.

  5. The results are written back through the PolicyExecution out output channel.