In Active Roles, entitlement profile specifiers are configuration objects that govern the process of building and presenting the entitlement profile. Each specifier holds information about a single resource that allows Active Roles to determine whether a given user is entitled to the resource and, if the user appears to be entitled, what information about that resource to include in the user’s entitlement profile.
An entitlement profile specifier holds the following information:
The following topics elaborate on each of these information blocks.
The entitlement type setting is basically intended to determine the entitlement target object—the object to which Active Roles applies the entitlement rules when building the entitlement profile. Entitlement types can be classified by how a user’s entitlement to a resource is configured:
The following table summarizes the types of entitlement.
Type |
Target Object | |
Personal resource entitlement |
The user’s account has certain resource-specific attributes set in the directory. |
The user’s account |
Shared resource entitlement |
The user’s account belongs to a certain security group in Active Directory. |
The user’s group |
Managed resource entitlement |
The user’s account is specified as the primary owner (manager) or a secondary owner of a certain object in the directory. |
The object managed or owned by the user |
When building a user’s entitlement profile, Active Roles uses a specifier’s entitlement rules to tell whether the user is entitled to the resource represented by that specifier. The rules are evaluated against the entitlement target object. If the object matches the rules, then Active Roles regards the user as entitled to the resource, and adds information about the resource to the user’s entitlement profile.
Entitlement rules can be classified by rule condition as follows:
For details on how Active Roles applies entitlement rules, see About entitlement profile build process later in this document.
For each resource that is to be included in the entitlement profile, Active Roles applies entitlement rules to single out the appropriate specifier and then it uses the resource display settings of that specifier to build the entitlement profile’s section that displays information about the resource.
The resource display settings include the following:
The entitlement profile’s section for a given resource is divided into two areas:
The Details area can be customized by adding HTML code to a certain attribute of the user account for which the entitlement profile is being built. The LDAP display name of that attribute should be supplied in the edsaHTMLDetailsAttribute of the entitlement profile specifier. As a result, Active Roles renders that HTML code instead of displaying the attributes list in the Details area.
© 2021 One Identity LLC. ALL RIGHTS RESERVED. Feedback Terms of Use Privacy