Each user is a static member of one organization, and can be a dynamic member of more than one organization.
You define organizational memberships using either of the following methods:
Direct (static) assignment. Select the Identity form tab on the Create User page or Edit User page to assign users directly to an organization. A user must be directly assigned to one organization.
Rule-driven (dynamic) assignment. Use a User Members Rule that is assigned to an organization to assign users to that organization. The rule, when evaluated, returns a set of member users.
Identity Manager evaluates the User Members Rule when:
Listing the users in an organization
Finding users (through the Find Users page) that includes searching for users that are in an organization with a User Members Rule
Requesting access to a user, provided that the current administrator controls an organization with a User Members Rule
For more information about creating and working with rules in Identity Manager, see Chapter 5, Working with Rules, in Sun Identity Manager Deployment Reference.
Select a User Members Rule from the User Members Rule menu on the Create Organization page. The following figure shows an example User Members Rule.
The following example illustrates the syntax for a sample User Members Rule used to dynamically control an organization’s user membership.
Before creating a User Members Rule, you should be aware of the following:
For a rule to appear in the User Members Rule option box, its authType must be set as authType=’UserMembersRule’.
The context is the currently authenticated Identity Manager user’s session.
The defined variable (defvar) Team players gets the distinguished name (dn) for each user that is a member of the Windows Active Directory organization unit (ou) Pro Ball Team.
For each user found, the append logic will concatenate the dn of each member user of the Pro Ball Team ou with the name of the Identity Manager Resource prefixed by a colon (as in :smith-AD).
The results returned will be a list of dn’s concatenated with the Identity Manager resource name in the format dn:smith-AD.
<Rule name=’Get Team Players’ authType=’UserMembersRule’> <defvar name=’Team players’> <block> <defvar name=’player names’> <list/> </defvar> <dolist name=’users’> <invoke class=’com.waveset.ui.FormUtil’ name=’getResourceObjects’> <ref>context</ref> <s>User</s> <s>singleton-AD</s> <map> <s>searchContext</s> <s>OU=Pro Ball Team,DC=dev-ad,DC=waveset,DC=com</s> <s>searchScope</s> <s>subtree</s> <s>searchAttrsToGet</s> <list> <s>distinguishedName</s> </list> </map> </invoke> <append name=’player names’> <concat> <get> <ref>users</ref> <s>distinguishedName</s> </get> <s>:sampson-AD</s> </concat> </append> </dolist> <ref>player names</ref> </block> </defvar> <ref>Team players</ref> </Rule>
You can configure several properties in Waveset. properties to control the rule-driven User Members list cache, which can affect memory and performance. For information, see Tracing Rule-Driven Members Caches in Sun Identity Manager 8.1 System Administrator’s Guide.