立即与支持人员聊天
与支持团队交流

Active Roles 8.1.5 - Administration Guide

Introduction Getting started with Active Roles Configuring rule-based administrative views Configuring role-based administration Rule-based autoprovisioning and deprovisioning
Provisioning Policy Objects Deprovisioning Policy Objects How Policy Objects work Policy Object management tasks Policy configuration tasks
Property Generation and Validation User Logon Name Generation Group Membership AutoProvisioning Exchange Mailbox AutoProvisioning AutoProvisioning in SaaS products OneDrive Provisioning Home Folder AutoProvisioning Script Execution Microsoft 365 and Azure Tenant Selection E-mail Alias Generation User Account Deprovisioning Office 365 Licenses Retention Group Membership Removal Exchange Mailbox Deprovisioning Home Folder Deprovisioning User Account Relocation User Account Permanent Deletion Group Object Deprovisioning Group Object Relocation Group Object Permanent Deletion Notification Distribution Report Distribution
Deployment considerations Checking for policy compliance Deprovisioning users or groups Restoring deprovisioned users or groups Container Deletion Prevention policy Picture management rules Policy extensions
Using rule-based and role-based tools for granular administration Workflows
Key workflow features and definitions About workflow processes Workflow processing overview Workflow activities overview Configuring a workflow
Creating a workflow definition for a workflow Configuring workflow start conditions Configuring workflow parameters Adding activities to a workflow Configuring an Approval activity Configuring a Notification activity Configuring a Script activity Configuring an If-Else activity Configuring a Stop/Break activity Configuring an Add Report Section activity Configuring a Search activity Configuring CRUD activities Configuring a Save Object Properties activity Configuring a Modify Requested Changes activity Enabling or disabling an activity Enabling or disabling a workflow Using the initialization script
Approval workflow Email-based approval Automation workflow Activity extensions
Temporal Group Memberships Group Family Dynamic groups Active Roles Reporting Management History Entitlement profile Recycle Bin AD LDS data management One Identity Starling Join and configuration through Active Roles Managing One Identity Starling Connect Configuring linked mailboxes with Exchange Resource Forest Management Configuring remote mailboxes for on-premises users Migrating Active Roles configuration with the Configuration Transfer Wizard Managing Skype for Business Server with Active Roles
About Skype for Business Server User Management Active Directory topologies supported by Skype for Business Server User Management User Management policy for Skype for Business Server User Management Master Account Management policy for Skype for Business Server User Management Access Templates for Skype for Business Server Configuring the Skype for Business Server User Management feature Managing Skype for Business Server users
Exchanging provisioning information with Active Roles SPML Provider Monitoring Active Roles with Management Pack for SCOM Configuring Active Roles for AWS Managed Microsoft AD Azure AD, Microsoft 365, and Exchange Online Management
Configuring Active Roles to manage Hybrid AD objects Unified provisioning policy for Azure M365 Tenant Selection, Microsoft 365 License Selection, Microsoft 365 Roles Selection, and OneDrive provisioning Changes to Active Roles policies for cloud-only Azure objects
Managing the configuration of Active Roles
Connecting to the Administration Service Managed domains Using unmanaged domains Evaluating product usage Creating and using virtual attributes Examining client sessions Monitoring performance Customizing the Console Using Configuration Center Changing the Active Roles Admin account Enabling or disabling diagnostic logs Active Roles Log Viewer
SQL Server replication Using regular expressions Administrative Template Configuring federated authentication Communication ports Active Roles and supported Azure environments Integrating Active Roles with other products and services Active Roles Language Pack Active Roles Diagnostic Tools Active Roles Add-on Manager

Resource display

For each resource that is to be included in the entitlement profile, Active Roles applies entitlement rules to single out the appropriate specifier and then it uses the resource display settings of that specifier to build the entitlement profile’s section that displays information about the resource.

The resource display settings include the following:

  • Resource type icon: Graphics that helps distinguish the type of the resource in the entitlement profile.

  • Resource type name: Text string that identifies the type of the resource in the entitlement profile.

  • Resource naming attribute: Entitlement target object’s attribute whose value is used to identify the resource in the entitlement profile.

  • Other resource-related attributes: List of the entitlement target object’s attributes whose values are to be displayed in the entitlement profile.

The entitlement profile’s section for a given resource is divided into two areas:

  • Heading: Displays the resource type icon, resource type name, and value of the resource naming attribute.

  • Details: Lists the names and values of the resource-related attributes.

The Details area can be customized by adding HTML code to a certain attribute of the user account for which the entitlement profile is being built. The LDAP display name of that attribute should be supplied in the edsaHTMLDetailsAttribute of the entitlement profile specifier. As a result, Active Roles renders that HTML code instead of displaying the attributes list in the Details area.

About entitlement profile build process

When requested to build a user’s entitlement profile, Active Roles performs the following steps.

  1. Prepare a list of the user’s groups, that is, a list of the security groups to which the user belongs whether directly or because of group nesting.

  2. Prepare a list of the user’s managed objects, that is, a list of the directory objects for which the user is assigned as the primary owner (manager) or a secondary owner.

  3. For each entitlement profile specifier of the personal resource entitlement type, evaluate the entitlement rules of that specifier against the user’s account. If the user’s account matches the entitlement rules, then add information about the resource to the entitlement profile, presenting the resource in accordance with the resource display settings found in the specifier.

  4. For each of the user’s groups, apply the entitlement profile specifiers of the shared resource entitlement type as follows:

    1. For each specifier, evaluate the entitlement rules of that specifier against the group.

    2. Once a specifier has been found such that the group matches its entitlement rules, then add information about the resource to the entitlement profile, presenting the resource in accordance with the resource display settings held in the specifier.

    3. If the group matches the entitlement rules of more than one specifier, apply the first specifier found and disregard the others.

  5. For each of the user’s managed objects, apply the entitlement profile specifiers of the managed resource entitlement type as follows:

    1. For each specifier, evaluate the entitlement rules of that specifier against the managed object.

    2. Once a specifier has been found such that the managed object matches its entitlement rules, then add information about the resource to the entitlement profile, presenting the resource in accordance with the resource display settings held in the specifier.

    3. If the managed object matches the entitlement rules of more than one specifier, apply the first specifier found and disregard the others.

Entitlement rules play a central part in the process of building the entitlement profile. It is the entitlement rules that determine whether Active Roles regards a given user as entitled to a given resource, and thus adds information about that resource to the user’s entitlement profile. When evaluating entitlement rules against a particular object, Active Roles performs the following steps.

  1. Apply the explicit exclusion rules. If the object is in the list of excluded objects, then disregard the remaining rules, and mark the object as not matching the rules. Otherwise, proceed to the next step.

  2. Apply the explicit inclusion rules. If the object is in the list of included objects, then disregard the remaining rules, and mark the object as matching the rules. Otherwise, proceed to the next step.

  3. Apply the filter-based exclusion rules. If the object satisfies the rule condition, then disregard the remaining rules, and mark the object as not matching the rules. Otherwise, proceed to the next step.

  4. Apply the filter-based inclusion rules. If the object satisfies the rule condition, then mark the object as matching the rules.

It may occur that the entitlement target object matches the entitlement rules of more than one specifier. In this case, Active Roles needs to choose a single specifier from those matching the entitlement target object. This is accomplished as follows:

  1. Examine the edsaPriority attribute of each specifier, and look for specifiers that have edsaPriority not set. If no such specifier found, then proceed to Step 3. If a single specifier found, then apply that specifier. Otherwise, proceed to Step 2.

  2. Range the specifiers that have edsaPriority not set in ascending alphanumeric order by name, and apply the specifier that goes first. Do not perform Steps 3–4.

  3. Choose the specifiers with the lowest edsaPriority value. If a single specifier has the lowest edsaPriority value, then apply that specifier. Otherwise, proceed to the next step.

  4. Range the specifiers with the lowest edsaPriority value in ascending alphanumeric order by name, and apply the specifier that goes first.

NOTE: Specifiers that have edsaPriority not set take precedence over those for which edsaPriority is set.

Once Active Roles has identified a single specifier for entitlement to a given resource, it uses the resource display settings of the specifier to build a section of the entitlement profile that displays information about the resource. If multiple resources match a particular specifier, then the sections specific to those resources are grouped together in an expandable block, to prevent the entitlement profile display from cluttering.

Entitlement profile configuration

In Active Roles, entitlement profile specifiers provide the ability to store the definition of entitlement to a particular resource in a single object. entitlement profile specifiers determine the contents of the entitlement profile.

When building the entitlement profile of a given user, Active Roles uses the entitlement profile specifiers to determine what resources the user is entitled to, and what information about each resource is to be shown in the entitlement profile.

Active Roles comes with a collection of predefined specifiers, and allows administrators to create additional specifiers or change existing specifiers. You can use the following instructions to create or change entitlement profile specifiers:

For a list of pre-defined specifiers, see Predefined specifiers.

Creating entitlement profile specifiers

Active Roles stores entitlement profile specifiers in the Entitlement Profile Specifiers container. You can access that container by expanding the Configuration > Server Configuration branch in the Active Roles Console tree.

To create an entitlement profile specifier

  1. In the Console tree, under Configuration > Server Configuration > Entitlement Profile Specifiers, right-click the container in which you want to create a new specifier, and select New > Entitlement Profile Specifier.

    For example, if you want to create a new specifier in the root container, right-click Entitlement Profile Specifiers.

  2. In the New Object - Entitlement Profile Specifier wizard, type a name and, optionally, a description for the new specifier.

    The name and description are used to identify the specifier object in the Active Roles Console.

  3. Click Next.

  4. Choose the desired type of entitlement:

    • Select the User attributes option if the fact that a given user is entitled to the resource stems from certain attribute settings of the user’s account in Active Directory. For example, this is the type of entitlement to an Exchange mailbox or to a home folder.

    • Select the Group membership option if the fact that a given user is entitled to the resource stems from membership of the user in a certain security group.

    • Select the Manager or owner role assignment option if entitlement of a given user to the resource means that the user is designated as the manager (primary owner) or a secondary owner of a certain object.

  5. Click Next.

  6. Set up the Entitlement rules list.

    In this step, you define the criteria that are used to determine whether a given user is entitled to the resource. The entitlement rules take the form of conditions that the entitlement target object must meet in order for the user to be regarded as entitled to the resource, and thus for information about the resource to appear in the entitlement profile of that user.

    Active Roles evaluates the entitlement rules against the entitlement target object when building a user’s entitlement profile. Depending on the entitlement type, the entitlement target object is:

    • In case of the User attributes entitlement type, the user account of the user whose entitlement profile is being built. This entitlement type is referred to as personal resource entitlement.

    • In case of the Group membership entitlement type, any single group to which the user belongs, whether directly or because of group nesting. This entitlement type is referred to as shared resource entitlement.

  7. You can define entitlement rules based on object properties, such as whether the object has certain attributes set or whether the object is a security group. The conditions take the form of LDAP filter based search criteria. With the Include rule type, the user is regarded as entitled to the resource if the entitlement target object meets the search criteria. With the Exclude rule type, the user is regarded as not entitled to the resource if the entitlement target object meets the search criteria.

  8. In addition to filter-based rules, you can configure rules on a per-object basis, so as to include or exclude individual objects from entitlement assignment explicitly. If Active Roles encounters a rule to include the entitlement target object, it considers the user as entitled to the resource. If Active Roles encounters a rule to exclude the entitlement target object, then it considers the user as not entitled to the resource.

  9. Active Roles evaluates the entitlement rules in the following order:

    1. Explicit exclusion

    2. Explicit inclusion

    3. Filter-based exclusion

    4. Filter-based inclusion

    Once the entitlement target object matches a rule of a particular type, the rule types that stand lower in this list are not applied. This means that exclusion rules take precedence over inclusion rules and explicit selection of objects takes precedence over filter-based rules.

    Initially, no entitlement rules are configured, which is treated as an inclusion-type condition that evaluates to TRUE for any object. As a result, entitlement to the resource is established regardless of the properties of the entitlement target object. You can add entitlement rules in order to categorize entitlements based on properties of entitlement target objects.

    To add an entitlement rule, click Include or Exclude depending on the rule type you want, and then use the Configure Entitlement Rule dialog to specify your search criteria. You can specify search criteria the same way you do when using the Find dialog. Then, do one of the following:

    • To add a rule based on the search criteria you specified, click Add Rule.

    • To select specific objects, click Find Now, select check boxes in the list of search results, and then click Add Selection.

  10. Click Next.

  11. View or change the icon that is used to distinguish the type of the resource in the entitlement profile:

    • View the icon in the area next to the Change button.

    • To choose a different icon, click Change and then select the desired image file.

    • To revert to the default icon, click Use Default Icon.

  12. Type the name of the resource type to be displayed in the entitlement profile.

  13. Click Select to choose the attribute of the entitlement target object whose value will be used to name the resource in the entitlement profile.

    The resource type icon, display name, and naming attribute are used to identify the resource in the entitlement profile. If the evaluation of the entitlement rules for a given user indicates that the user is entitled to the resource, then information about the resource appears as a separate section in the entitlement profile of that user. The heading of the section includes the resource type icon, the display name of the resource type, and the value of the naming attribute retrieved from the entitlement target object.

  14. Click Next.

  15. Set up the list of the resource-related attributes that will be displayed in the entitlement profile:

    • Use Add or Remove to add or remove attributes from the list.

    • Click Add Separator to divide the attribute list into sections in the entitlement profile.

    • Use the Up and Down buttons to arrange the attribute list order.

    The attributes held in the list will be displayed in the entitlement profile, beneath the heading of the section that provides information about the resource. For each of the listed attributes, the section displays the name and the value of the attribute retrieved from the entitlement target object.

  16. Click Next, and then click Finish.

相关文档

The document was helpful.

选择评级

I easily found the information I needed.

选择评级