34.1 Role-based Entitlement

An RBE policy is an OpenText Identity Console dynamic group object with additional features added to let you grant RBEs on connected systems. When you create an RBE policy, you define the membership for the policy and the entitlements that should be granted to the members of the RBE policy. Each RBE policy is associated with a single Driver Set object assigned to a particular server. Like an OpenText Identity Manager driver, each Entitlement policy can manage only objects that are in a master or read/write replica on the server to which it is assigned.

The following sections explain in detail about Role-based Entitlement:

34.1.1 Summary

This page summarizes a high-level view of the membership criteria and entitlements for the Entitlement policy.

Membership:

The criteria specified for dynamic membership are displayed in the syntax of an LDAP filter. Search Identity indicates which object's rights are used when querying for dynamic membership, and the Base DN and Scope indicate what part of the tree is included in the query.

You can view the static membership inclusions and exclusions by selecting the check box.

The combined list of all members is not displayed on the Summary page because the list might be long. To see a combined list of all the members of the Entitlement policy, both dynamic and static, use the Membership > View Membership tab.

Entitlements:

The entitlements on connected systems that are granted to members of the Entitlement policy. Keep in mind that Role-Based Entitlements are loosely consistent with the connected systems. This means that the status of an entitlement on a connected system is not displayed in the Entitlement Policy interface. If you grant an entitlement to an Entitlement policy, and later that entitlement is no longer available on the connected system, the entitlement is still listed in the Entitlement policy until you manually remove it from the list.

Conflict Resolution:

For RBEs that have values, these method are used to determine which values are granted to a user if two or more RBE policies grant different values to that user. An example of an entitlement that has values is membership in email distribution lists, where the values are the names of the distribution lists.

The conflict resolution method is set separately for each individual entitlement on each driver object. If an entitlement is used in multiple RBE policies, the conflict resolution method is the same across all RBE policies. To change the conflict resolution method for an entitlement, change the setting for that entitlement in the driver manifest for the driver.

Unrecognized: The RBE policy has not been completed in the wizard, or the setting has been typed incorrectly in the driver manifest.
Merge: The default setting is Merge (union in the driver manifest). This means that a user is granted all values for this entitlement from all RBE policies he or she is a member of.

When using the default setting of Merge, the priority order of the list of policies is not important for this particular entitlement.

For example, a user is granted membership in email distribution lists for GroupWise® Driver A by two different RBE policies, the Managers policy and the Team Members policy. In Policy 1, the user is granted membership in the Managers email distribution list, and in Policy 2, the user is granted membership in the Team Members email distribution list. With a setting of Merge, the user is granted membership in both email distribution lists.
Priority: This setting means that if multiple RBE policies grant a user different values for the same entitlement from the same driver object, the user is granted only the values that are specified in the RBE policy that is highest in the list.

When using the Priority setting, the priority order of the list of policies is important for this particular entitlement.

For example, a user is granted membership in email distribution lists for GroupWise Driver A by two different RBE policies, the Managers policy and the Team Members policy. In the Managers policy, the user is granted membership in the Managers email distribution list, and in the Team Members policy, the user is granted membership in the Team Members email distribution list. The Managers policy is listed higher in the list of policies than the Team Members policy. With a setting of Priority, the user is granted membership only in the Managers email distribution list.

Using priority for conflict resolution might be useful if, for example, an attribute on the connected system only allows a single value. If two different RBE policies grant a value for that attribute to the same user, the user receives the value that is granted by the RBE policy that is highest in the list.

NOTE:A conflict resolution setting is not provided for entitlements that have no values, such as an account. Entitlements that have no values are always granted to members of the RBE policy, regardless of the priority of policies in the list.

34.1.2 Dynamic Members

Membership Filter

You can define criteria for membership, such as location in the tree and attributes of the object. For example, membership could be dependent on whether the user is in the Active container, or whether the job title includes the word Manager. Users who meet the criteria are automatically members of the RBE policy, without requiring you to specifically add each user to the policy. The dynamic membership is the same as a Dynamic Group object.

If an object changes so that it no longer meets the criteria for dynamic membership, the entitlements are automatically revoked the next time when the user is reevaluated.

Set Search Parameters

Specify the location of the users you want the Entitlement policy to manage. Choose the container that holds the users (Base DN), and how far down from that container you want the search to go (Scope of Search). For the Entitlement policy to manage users in the containers you specify, the users must be in a read/write or master replica on the server.

The following options are provided for Scope of Search:

This container and its subcontainers: Users below this container in the tree are members of the Entitlement policy if they meet the criteria specified for dynamic membership. Users inside subcontainers are also members if they meet the criteria.
This container only: Users inside this container are members of the Entitlement policy only if they meet the criteria specified for dynamic membership. Users inside subcontainers below this container are not members even if they meet the criteria.

Define Filter Criteria

Specify the characteristics that determine which users are members of the Entitlement policy.

In the Summary page for an Entitlement policy, the dynamic membership criteria you specify are displayed in the syntax of an LDAP filter.

By default, dynamic membership is set to include all User class objects (and objects of classes derived from the User class) within the search scope as members of the Entitlement policy.

NOTE:If you create a new object class derived from User, an existing Entitlement policy does not become aware of that class until you make a modification to the Entitlement policy. This prevents users of a new class from being granted entitlements unintentionally. When any modification is made to the Entitlement policy, the list of user-derived classes for that policy is updated.

Creating Dynamic Membership

On the Dynamic Members tab, perform the following:

Click the Dynamic Members tab.
Use the Search Identity, Begin Search at, and the Search Scope filters as per your requirement.
Click the specific Create Group to create a new condition or a row, then provide the required search criteria or condition.

Search Scope: The Search Scope indicates the set of entries at or below the search base DN that may be considered potential matches for a search operation.

Search Criteria: You can limit a search to help you locate a specific record or group of records from a large number of records.

Base DN: A Base DN is the point from where a server will search for users.

LDAP Group: It is a hierarchical organization of Users, Groups, and Organizational Units which are containers for users and groups.

NOTE:The user can create single or multiple groups with conditions. The conditions consist of attributes, operators, and value. By default, Object Class > is equal > User is populated.

34.1.3 Static Members

Static Members are class of members that are declared using static keywords. A static member has certain limited accesses.

On the Static Members tab, the following operations can performed:

Include Members:

Add members statically who are not included by the dynamic membership filter.

Exclude Members:

Exclude members that meet the filter’s criteria but should not be included in the entitlement policy.

34.1.4 Entitlements

RBE lets you grant entitlements on connected systems and rights in OpenText Identity Manager. Entitlements can be any of the following:

Accounts on connected systems.
Membership in email distribution lists on connected systems.
Group membership on connected systems.
Attributes for the corresponding objects in connected systems, populated with the values you specify.

NOTE:The Entitlements functionality is part of OpenText Identity Manager, so, you must have OpenText Identity Manager drivers installed and configured to support Entitlements before you can grant entitlements on connected systems.

Create Entitlement

On the Entitlements tab, perform the following:

Click the Entitlement tab.
Click to Add Drivers and to provide entitlements on connected systems.

Add Driver screen appears.
Select the driver from the drop-down menu.
Click Add.

The Add Entitlements screen appears.
From the drop-down menu Select an Entitlement group that you want to add.
Select the Query Type:
- Cached: When queries are previously run.
- External Query: When queries are new.
The Add Group Entitlement screen appears.
Select group entitlement from the drop-down menu, then click Select.

34.1.5 Rights to other Objects

Use this page to give an Entitlement policy trustee rights to an OpenText eDirectory object. Each member of the Entitlement policy becomes a trustee of the object.

In addition to assigning rights to all attributes, you can click Add Property to assign rights to specific properties.

The Inherit check box determines whether the rights flow down in the tree. For example, if you are assigning rights to a container object, and you want the Entitlement policy to have the same rights to the objects and sub-containers that are below that container, select the Inherit check box.

Rights to objects in OpenText eDirectory are granted to members of the Entitlement policy after you complete your changes on this page. By contrast, entitlements in connected systems are granted to each member of the Entitlement policy the next time an attribute used for dynamic membership is modified for that user, or the user is moved or renamed. (The same is true when rights and entitlements are revoked.) Use the Reevaluate Membership task to force an update.

Create Rights to other Objects

To create rights:

Click on the Rights to Other Objects tab

Here you can add a new Object, and browse for those Objects that you want this Entitlement Policy to be a trustee.
1. To add an object click button.
  
  The CONTEXT BROWSER page appears. The page consists of Objects.
2. Expand the Objects and select Groups or individual Users as per your requirement and assign rights to them.
3. To add more properties, click .
  
  The SELECT PROPERTIES page appears. This page has the list of Properties that an Object can have.
4. Click Done.
(Optional) Using the Up and Down arrows prioritize the RBE Policies.

Prioritizing the policy is to resolve entitlement conflicts between multiple policies. The topmost policy has highest priority. For more information see: Prioritize RBE Policies

34.1.6 Prioritize RBE Policies

When you create RBE policies, it is possible that the policies affecting a particular user might conflict.

The order of RBE policies in the list represents priority. You can change the order of the list by using the up-arrow and down-arrow buttons.

This setting might be useful if, for example, an attribute on the connected system allows only a single value. If two different RBE policies grant a value for that attribute to the same user, the user receives the value that is granted by the highest RBE policy in the list. As another example, perhaps you configured your environment to use Entitlements to place users in a hierarchical structure on another system. You would want the user to be placed in either one place or another, not two places at the same time.
Keep in mind that the setting is independent for each entitlement offered by each driver.
As a rule, you should place administrator or manager policies higher in the list than policies for end users or individual contributors. You should put groups with narrower membership higher than groups with broader membership.

To prioritize RBE policies:

Select the Entitlement Policy that you want to upgrade or down-grade.
By using Up or Down arrow prioritize the RBE Policies.
Click Save button.

The summary of the policy membership details is displayed in the Summary tab.
Restart the driver.

NOTE:You must restart the driver for the changes to take effect.