34.2 Re-Evaluate Membership

The Role-based Entitlements feature lets you grant entitlements on connected systems to a group of users.

When you create or edit an RBE policy, each user's membership must be reevaluated to determine whether entitlements on connected systems need to be granted, changed, or revoked. By default, reevaluation takes place for users one at a time, the next time an attribute that affects membership is changed for each user, or when a user is moved or renamed. This default behavior minimizes the use of system resources, but it means that there might be a significant delay between the time the RBE policy is changed, and the time entitlements are granted, changed, or revoked for a particular user.

You can make sure that the user entitlements are updated all at once by using the Re-Evaluate RBE Policies task to specify users who should be immediately reevaluated. We recommend that you do this each time you create or edit an RBE policy.

Prior to OpenText Identity Manager 3.6, reevaluating membership was performed for all RBE policies in a driver set, not for an individual Entitlement policy. However, OpenText Identity Manager 3.6 allows you to Evaluate an RBE policy and Add its members to the selected Objects List. If you have defined an Entitlement policy and have created a membership list, you will see the Evaluate an Entitlement Policy to Add its members to the list heading next to the selected Objects entry. Select the policy, then click the icon to add the policy's members to the selected Objects List. You can add or remove members or objects from the selected Objects List.

To make the best use of system resources, you should make all your changes to RBE policies in a particular driver set before using Re-Evaluate RBE Policies.

NOTE:Reevaluating entitlements is necessary only for entitlements on connected systems. When OpenText Identity Console rights are changed for an RBE policy, the changes are effective immediately for each user. You must have the Entitlements Service driver running for membership re-evaluations to be performed.

34.2.1 Re-Evaluate RBE Policies

To re-evaluate the membership:

  1. Click Re-Evaluate Membership > Select Driver Set.

    A list of policies that are created will appear.

  2. Select the policy that needs to be evaluated, and click Evaluate .

    At the Objects tab, users that are part of the group will appear.

  3. (Optional) To add a specific user click .

    When users are missing from the list, and you want to add specific users, only then you can use this Add feature.

  4. (Optional) To remove specific user click .

    When specific users need to be removed from the list, only then you can use the Delete feature.

  5. Click Re-evaluate Membership button .