member-assignment-query

It is applicable for <entitlement> type account only. The Identity Manager Data Collection Service (DCS) should be able to obtain the member assignment information from the managed and unmanaged accounts. Because member assignment information can get bulky when the groups and roles have many assigned members, the query extensions to retrieve this information are optional. Appropriate query extensions should be added to the querying agent. Member assignment information is available on both account and group entitlements but it must be retrieved slightly differently. For entitlement with account type name, the content of the query-xml child node of the member-assignment-query node is expected to be a full query definition that replaces the potentially existing query defined in the entitlement XML.

<member-assignment-query>
  <query-attr name="query-type">entitlement-assignment</query-attr>
  <query-xml>
    <nds dtdversion="2.0">
      <input>
        <query class-name="User" scope="subtree">
          <search-class class-name="User"/>
          <read-attr/>
        </query>
      </input>
    </nds>
  </query-xml>
</member-assignment-query>