Policy Xpress › How to Create a Policy › Action Rules › Set Objects Associated with Accounts

Set Objects Associated with Accounts

When creating an Add Action to set an object that is associated with an account, such as Member Of, a specific relationship format is used to represent the object. The following two types of formats can represent the object in CA Identity Manager:

• To represent simple relationships between the object and the account, for example, Active Directory Groups:

  NativeGroup=Administrators,Container=Builtin,EndPoint=LocalAD,Namespace=ActiveDirectory,Domain=im,Server=Server
  

• To represent binding relationships between the object and the account, for example, SAP Roles:

  {"validFromDate":"2009\/12\/01","roleName":"SAPRole=SAP_AUDITOR_ADMIN,EndPoint=sap endpoint,Namespace=SAP R3,Domain=im,Server=Server","validToDate":"2009\/12\/31"}
  

  A binding relationship differs from a simple relationship in that the association between the object and the account has additional data on it. In the previous example, the parameters validFromDate and validToDate only contain data related to the association between the account and the SAP role. The validFromDate and validToDate data does not exist on the account, or the role object.

To discern the format for the relationship, create a data element that Gets the value of the object. The value returned is the format you use in the Add Action to set that object.

Example: Active Directory Groups

1. Create a Policy Xpress policy with the following settings:
   • Policy Type: Event
   • Events: After – Modify User
2. In the Action Rule, configure the following Add Action:
   • Category: Attributes
   • Type: Set Account Data
   • Function: Set
   • Endpoint Type: Active Directory
   • Endpoint: endpoint_name
   • Account Name: account
   • Attribute: Member Of (groupMembership)
   • Value: NativeGroup=Administrators,Container=Builtin,Endpoint=endpoint_name,Namespace=ActiveDirectory,Domain=im,Server=Server