Active Roles stores entitlement profile specifiers in the Entitlement Profile Specifiers container. You can access that container by expanding the Configuration/Server Configuration branch in the Active Roles console tree.

To create an entitlement profile specifier

1. In the console tree, under Configuration/Server Configuration/Entitlement Profile Specifiers, right-click the container in which you want to create a new specifier, and select New | Entitlement Profile Specifier.

   For example, if you want to create a new specifier in the root container, right-click Entitlement Profile Specifiers.

2. In the New Object - Entitlement Profile Specifier wizard, type a name and, optionally, a description for the new specifier.

   The name and description are used to identify the specifier object in the Active Roles console.

3. Click Next.
4. Choose the desired type of entitlement:
   • Select the User attributes option if the fact that a given user is entitled to the resource stems from certain attribute settings of the user’s account in Active Directory. For example, this is the type of entitlement to an Exchange mailbox or to a home folder.
   • Select the Group membership option if the fact that a given user is entitled to the resource stems from membership of the user in a certain security group.
   • Select the Manager or owner role assignment option if entitlement of a given user to the resource means that the user is designated as the manager (primary owner) or a secondary owner of a certain object.
5. Click Next.
6. Set up the Entitlement rules list.

   In this step, you define the criteria that are used to determine whether a given user is entitled to the resource. The entitlement rules take the form of conditions that the entitlement target object must meet in order for the user to be regarded as entitled to the resource, and thus for information about the resource to appear in the entitlement profile of that user.

   Active Roles evaluates the entitlement rules against the entitlement target object when building a user’s entitlement profile. Depending on the entitlement type, the entitlement target object is:

• In case of the User attributes entitlement type, the user account of the user whose entitlement profile is being built. (This entitlement type is referred to as personal resource entitlement.)
• In case of the Group membership entitlement type, any single group to which the user belongs, whether directly or because of group nesting. (This entitlement type is referred to as shared resource entitlement.)

7. You can define entitlement rules based on object properties, such as whether the object has certain attributes set or whether the object is a security group. The conditions take the form of LDAP filter based search criteria. With the “Include” rule type, the user is regarded as entitled to the resource if the entitlement target object meets the search criteria. With the “Exclude” rule type, the user is regarded as not entitled to the resource if the entitlement target object meets the search criteria.
8. In addition to filter-based rules, you can configure rules on a per-object basis, so as to include or exclude individual objects from entitlement assignment explicitly. If Active Roles encounters a rule to include the entitlement target object, it considers the user as entitled to the resource. If Active Roles encounters a rule to exclude the entitlement target object, then it considers the user as not entitled to the resource.
9. Active Roles evaluates the entitlement rules in the following order:
   1. Explicit exclusion
   2. Explicit inclusion
   3. Filter-based exclusion
   4. Filter-based inclusion

   Once the entitlement target object matches a rule of a particular type, the rule types that stand lower in this list are not applied. This means that exclusion rules take precedence over inclusion rules and explicit selection of objects takes precedence over filter-based rules.

   Initially, no entitlement rules are configured, which is treated as an inclusion-type condition that evaluates to TRUE for any object. As a result, entitlement to the resource is established regardless of the properties of the entitlement target object. You can add entitlement rules in order to categorize entitlements based on properties of entitlement target objects.

   To add an entitlement rule, click Include or Exclude depending on the rule type you want, and then use the Configure Entitlement Rule dialog box to specify your search criteria. You can specify search criteria the same way you do when using the Find dialog box. Then, do one of the following:

• To add a rule based on the search criteria you specified, click Add Rule.
• To select specific objects, click Find Now, select check boxes in the list of search results, and then click Add Selection.

7. Click Next.
8. View or change the icon that is used to distinguish the type of the resource in the entitlement profile:
   • View the icon in the area next to the Change button.
   • To choose a different icon, click Change and then select the desired image file.
   • To revert to the default icon, click Use Default Icon.
9. Type the name of the resource type to be displayed in the entitlement profile.
10. Click Select to choose the attribute of the entitlement target object whose value will be used to name the resource in the entitlement profile.

    The resource type icon, display name, and naming attribute are used to identify the resource in the entitlement profile. If the evaluation of the entitlement rules for a given user indicates that the user is entitled to the resource, then information about the resource appears as a separate section in the entitlement profile of that user. The heading of the section includes the resource type icon, the display name of the resource type, and the value of the naming attribute retrieved from the entitlement target object.

11. Click Next.
12. Set up the list of the resource-related attributes that will be displayed in the entitlement profile:
    • Use the Add or Remove button to add or remove attributes from the list.
    • Click Add Separator to divide the attribute list into sections in the entitlement profile.
    • Use the Up and Down buttons to arrange the attribute list order.

    The attributes held in the list will be displayed in the entitlement profile, beneath the heading of the section that provides information about the resource. For each of the listed attributes, the section displays the name and the value of the attribute retrieved from the entitlement target object.

13. Click Next, and then click Finish.