[IBM Tivoli Identity Manager learning document] 17. Account allocation

Author: gnuhpc
Source: http://www.cnblogs.com/gnuhpc/

 

1. Previous work:

• Added;
• Create an organizational unit role and add this person to it;
• Create a service;
• Create an Identity Policy;
• Create an allocation policy;
• Configure provisioning policy entitlements;

2. Create an allocation policy:

Two parts need to be set --

Membership: Who has access permissions.

Entitlements: resources that can be provided to the user.

This policy also defines what actions should be performed in the event of illegal operations.

The account entitlement defines which resources are used by users and can be bound to workflow to design the application process. It can also set whether to automatically allocate resources or manually apply for resources. A smaller number indicates a higher priority.

3. provisioning policy join ctictives

It is used to resolve allocation policy conflicts in attribute processing. When multiple allocation policies are applied to the same user, the allocation policy takes effect first (generally, the allocation policy is evaluated based on the priority ).

The specific operations are as follows:

4. Entitlement Parameters

The parameters entered during permission assignment can be customized in manage provisioning policies. You can set the default value, mandatory value, and value type. You can also use JavaScript for automatic filling.

The following syntax is commonly used to write javascript: subject. getproperty ("attribute ")

For example:

VaR value = subject. getproperty ("Sn ");
If (value. length> 0 ){
Return Value [0]
Else {
Return "";
}

When we want to make different trade-offs between a new user and an existing user, the account has a reason attribute, 0 is a new account, and 1 is an existing user.

(If (reason = 0) (return 30;) else (return 60 ;))

5. workflow binding. For an entitlement, a service is bound to a workflow.

6. Compliance Alerts: the emergence of illegal accounts caused by policy changes. This function serves as a reminder.

Author: gnuhpc
Source: http://www.cnblogs.com/gnuhpc/