ResolveInconsistentGroupMembership

Perform Execution of 'ResolveInconsistentGroupMembership' rule in Identity Store

ResolveInconsistentGroupMembership detects group memberships in the Identity Store that are inconsistent with the current privilege assignments — for example, a user who appears in a group but whose role assignments no longer grant that membership. The PolicyAgent corrects the memberships by applying the relevant policies with suppresschangeevents set to TRUE, which means the corrections are applied silently without raising change events that would trigger the event-based provisioning workflows.

The workflows in this reference are delivered as factory data and are loaded into the Connectivity configuration database during the initial configuration. They are samples: use the Identity Manager to copy a workflow into your own scenario and adapt the copy. Do not change the delivered objects, because a product update can replace them.

At a Glance

Name

ResolveInconsistentGroupMembership

Prerequisites

The PolicyAgent must be deployed and configured in the C++-based Server.
The ResolveInconsistentGroupMembership in and ResolveInconsistentGroupMembership out channels must be configured.

Workflow and Activities

Step Activity Description Agent Runs after

Step	Activity	Description	Agent	Runs after
1	`PolicyExecution`	Policy execution via DirX Identity Policy agent	`PolicyAgent`	start activity

PolicyExecution

Policy execution via DirX Identity Policy agent

PolicyAgent

start activity

Jobs and Agents

Activity Job Agent Operation Input channel Output channel

Activity	Job	Agent	Operation	Input channel	Output channel
`PolicyExecution`	`ResolveInconsistentGroupMembership`	`PolicyAgent`	Full Import	`PolicyExecution in-ResolveInconsistentGroupMembership`	`PolicyExecution out-ResolveInconsistentGroupMembership`

PolicyExecution

ResolveInconsistentGroupMembership

PolicyAgent

Full Import

PolicyExecution in-ResolveInconsistentGroupMembership

PolicyExecution out-ResolveInconsistentGroupMembership

Configuration Parameters

Table 1. Parameters of job `ResolveInconsistentGroupMembership`
Parameter	Default value
`delta_mode`	full
`delta_on`	0
`mode`	AssignOnly
`request`	process
`suppresschangeevents`	TRUE
`trace`	2

A Tcl-based workflow runs scheduled in the C++-based Server (IdS-C). Its activities run in the order defined by the dxmPredecessorActivity-DN chain, and each activity starts a job that runs one agent with one input and one output channel. Agents exchange their data through files or directly through the meta controller, so a typical workflow consists of an export activity that writes the data of the connected system and an import activity that maps and loads that data into the Identity Store.

You start these workflows manually from the Identity Manager or attach them to a schedule.

The workflow has a single activity, ResolveInconsistentGroupMembership, which runs the PolicyAgent job of the same name. The job reads group membership entries from the ResolveInconsistentGroupMembership in input channel and corrects the inconsistencies. The suppresschangeevents parameter is TRUE so that the corrections do not trigger additional change events. Updated entries are written to the ResolveInconsistentGroupMembership out output channel.

Operation

You start the workflow manually from the Identity Manager or attach it to a schedule.
The C++-based Server starts the ResolveInconsistentGroupMembership activity and launches the PolicyAgent job.
The agent reads group membership entries from the Identity Store through the ResolveInconsistentGroupMembership in input channel.
For each entry the agent evaluates the current role assignments and corrects any membership that is inconsistent with them.
Because suppresschangeevents is TRUE, the corrections are not published as change events and the event-based provisioning workflows are not triggered.
Updated entries are written back through the ResolveInconsistentGroupMembership out output channel.