PrivilegeResolution

Performs privilege resolution in Identity Store

PrivilegeResolution runs the role service agent to calculate the current privilege set for every user in the Identity Store and writes the resulting account and membership changes into the target system subtrees. Use it for a full recalculation of all user privileges — for example after a bulk change to roles, policies or assignments, after the initial configuration of the Identity Store, or as a safety net after the event-based maintenance workflows were inactive.

The workflows in this reference are delivered as factory data and are loaded into the Connectivity configuration database during the initial configuration. They are samples: use the Identity Manager to copy a workflow into your own scenario and adapt the copy. Do not change the delivered objects, because a product update can replace them.

At a Glance

Name

PrivilegeResolution

Category

Identity Store

Technology

Tcl-based scheduled workflow

LDAP object class

dxmWorkflow

Workflow type

-

Connected system / controller type

-

Configuration wizard

LDAP-LDAP

Active in the factory data

not set

Factory data version

7.0

Factory data path

Workflows/Default/Identity Store/PrivilegeResolution

Prerequisites

  • The ServiceAgent must be deployed and configured in the C++-based Server.

  • The Default input channel and the PrivilegeResolution out output channel must be configured.

Workflow and Activities

Step Activity Description Agent Runs after

1

PrivilegeResolution

Privilege resolution via role service agent

ServiceAgent

start activity

Jobs and Agents

Activity Job Agent Operation Input channel Output channel

PrivilegeResolution

PrivilegeResolution

ServiceAgent

Full Import

Default

PrivilegeResolution out

Configuration Parameters

Table 1. Parameters of job PrivilegeResolution
Parameter Default value

delta_mode

full

delta_on

0

ldaptrace

FALSE

ldaptracelines

0

request

resolution

trace

1

A Tcl-based workflow runs scheduled in the C++-based Server (IdS-C). Its activities run in the order defined by the dxmPredecessorActivity-DN chain, and each activity starts a job that runs one agent with one input and one output channel. Agents exchange their data through files or directly through the meta controller, so a typical workflow consists of an export activity that writes the data of the connected system and an import activity that maps and loads that data into the Identity Store.

You start these workflows manually from the Identity Manager or attach them to a schedule.

The workflow has a single activity, PrivilegeResolution, which runs the ServiceAgent job of the same name. The job reads user entries from the Default input channel with request set to resolution, which instructs the service agent to perform a full privilege resolution pass and write the resulting changes to the PrivilegeResolution out output channel.

Operation

  1. You start the workflow manually from the Identity Manager or attach it to a schedule.

  2. The C++-based Server starts the PrivilegeResolution activity and launches the ServiceAgent job.

  3. The agent connects to the Identity Store and reads all users through the Default input channel.

  4. For each user the service agent evaluates the role assignments, policies and constraints that determine the user’s current privilege set.

  5. The resulting account and membership changes are written into the target system subtrees of the Identity Store and passed to the PrivilegeResolution out output channel.

  6. The target system provisioning workflows then pick up the account and membership changes and apply them to the connected systems.