Identity Manager Rules

You can use the following rules and rule libraries to customize Identity Manager.

• AccessEnforcerLibrary

• ActiveSync Rules

• ADRules Library

• AlphaNumeric Rules Library

• Approval Transaction Message

• Approval Transaction Message Helper

• Attestation Remediation Transaction Message

• Attestation Remediation Transaction Message Helper

• Attestation Transaction Message

• Attestation Transaction Message Helper

• CheckDictionaryWord

• DateLibrary

• End User Controlled Organizations

• EndUserRuleLibrary

• ExcludedAccountsRule

• getAvailableServerOptions

• InsertDictionaryWord

• IS_DELETE

• Is Manager

• LoginCorrelationRules

• My Direct Reports

• NamingRules Library

• NewUsernameRules

• Object Approvers As Attestors

• Object Owners As Attestors

• Organization Names

• OS400UserFormRules

• RACFUserFormRules

• Reconciliation Rules

• RegionalConstants Library

• Remediation Transaction Message

• Remediation Transaction Message Helper

• ResourceFormRules

• Resource Names

• Role Approvers

• Role Notifications

• Role Owners

• Sample On Local Network

• SAP Portal User Form Default Values

• ShellRules

• SIEBEL_NAV_RULE

• TestDictionary

• TopSecretUserFormRules

• User Members Rule

• USER_EMAIL_MATCHES_ACCOUNT_EMAIL_CONF

• USER_EMAIL_MATCHES_ACCOUNT_EMAIL_CORR

• USER_FIRST_AND_LAST_NAMES_MATCH_ACCOUNT

• USER_NAME_MATCHES_ACCOUNT_ID

• USER_OWNS_MATCHING_ACCOUNT_ID

• Users Without a Manager

• Use SubjectDN Common Name

AccessEnforcerLibrary

The AccessEnforcerLibrary is a default library of rules that enable you to manage certain types of objects because the Access Enforcer resource adapter does not provide a way for you to fetch these objects.

Inputs: See Table 4–2.

You must specify the following for a custom AccessEnforcerLibrary rule:

The following table describes the example AccessEnforcerLibrary rules.

ActiveSync Rules

When the Flat File Active Sync adapter detects a change to an account on a resource, it either maps the incoming attributes to an Identity Manager user, or it creates an Identity Manager user account. The adapter uses process, correlation, and delete rules to determine what to do with the user.

Active Sync rules must use context, not display.session. Correlation and Delete rules do not get a session, but Confirmation rules do. For more information, see Correlation Rule and Confirmation Rule.

Inputs: These rulesaAccept resource account attributes in the activeSync namespace. For example, activeSync.firstname.

You must specify the following for a custom ActiveSync rule:

activeSync.firstname

ADRules Library

The default library of ADRules enables you to create a list of the servers

Inputs: None

You must specify the following for a custom ADRules rule:

AlphaNumeric Rules Library

The AlphaNumeric Rules Library is a default library of rules that enable you to control how numbers and letters are ordered and displayed in Identity Manager forms and workflows.

This library is displayed as the Alpha Numeric Rules library object in the Identity Manager IDE.

Inputs: See Table 4–4

You must specify the following for a custom rule:

The following table describes rules in the AlphaNumeric Rules library.

Approval Transaction Message

The Approval Transaction Message rule is a default rule used to format approval transaction text. You can customize this rule to provide more information for a user to sign.

Inputs: Accepts the following arguments:

• workItemList: A set of workitems that are being approved.

• variablesList: A set of variables corresponding to each workitem in workitemList.

• approverName: User being asked to approve the workitems.

You must specify the following for a custom Approval Transaction Message rule:

Approval Transaction Message Helper

The Approval Transaction Message Helper rule returns the formatted transaction text for the approval of a single workitem.

Inputs: Accepts the following arguments:

• workItem: The workitem that is being approved.

• variables: The workitem variables.

You must specify the following for a custom Approval Transaction Message Helper rule:

Attestation Remediation Transaction Message

The Attestation Remediation Transaction Message rule is a default rule used to format attestation remediation transaction text. You can customize this rule to provide more information for the user to sign.

Inputs: Accepts the following arguments:

• workItemList: A set of workitems that are being approved.

• variablesList: A set of variables corresponding to each workitem in workitemList.

• approverName: User being asked to approve the workitems.

• action: Expected to be remediate.

• actionComments: Comments that are entered as part of the remediation.

You must specify the following for a custom Attestation Remediation Transaction Message rule:

Attestation Remediation Transaction Message Helper

The Attestation Remediation Transaction Message Helper rule returns the formatted transaction text for the attestation remediation of a single workitem.

Inputs: Accepts the following arguments:

• workItem: The workitem that is being approved.

• variables: The workitem variables.

You must specify the following for a custom Attestation Remediation Transaction Message Helper rule:

Attestation Transaction Message

The Attestation Transaction Message rule a default rule used to format attestation transaction text. You can customize this rule to provide more information for the user to sign.

Inputs: Accepts the following arguments:

• workItemList: A set of workitems that are being approved.

• variablesList: A set of variables corresponding to each workitem in workitemList.

• approverName: User being asked to approve the workitems.

• action: Expected to be aproved or approve.

• actionComments: Comments that are entered as part of the attestation.

You must specify the following for a custom Attestation Transaction Message rule:

Attestation Transaction Message Helper

The Attestation Transaction Message Helper rule returns the formatted transaction text for the a single attestation.

Inputs:

Accepts the following arguments:

• workItem: The workitem that is being approved.

• variables: The workitem variables.

You must specify the following for a custom Attestation Transaction Message Helper rule:

CheckDictionaryWord

Use the CheckDictionaryWord rule to run a JDBC query against a dictionary to check if a password exists in the dictionary.

Inputs:

Accepts the following arguments:

• type

• driverClass

• driverPrefix

• url

• host

• port

• database

• context

• user

• password

• sql

• arg1

You must specify the following for a custom CheckDictionaryWord rule:

DateLibrary

The DateLibrary is a default library of rules that control how dates and times are displayed in a deployment.

This library is displayed as the Date Library library object in the Identity Manager IDE.

Inputs:

See Table 4–5.

You must specify the following for a custom DateLibrary rule:

The following table describes the example DateLibrary rules.

End User Controlled Organizations

The End User Controlled Organizations rule determines the set of organizations that are controlled by a user logging into the End User interface. These organizations, together with the End User organization, define the scope of control over which a user is granted the permissions specified in the EndUser capability (AdminGroup). Because this is a rule, it allows the scope of control to vary depending on which user is logging into the End User interface.

Inputs:

User view of the authenticating end user

You must specify the following for a custom End User Controlled Organizations rule:

EndUserRuleLibrary

The EndUserRuleLibrary is a default library of rules that Identity Manager uses to determine or to verify end-user account information.

By default, Identity Manager’s End User Anonymous Enrollment processing generates values for accountId and emailAddress by using user-supplied first names (firstName), last names (lastName) and employee IDs (employeeID). Anonymous enrollment can cause non-ASCII characters to display in email addresses and account IDs.

To ensure that Identity Manager maintains ASCII accountIds and email addresses during anonymous enrollment processing, international users must perform these steps:

To Use EndUserRuleLibrary in Localized Environments

1. Modify the following EndUserRuleLibrary rules:

   • getAccountId: Remove firstName, lastName, and letter substr. Use employeeId only.

     • getEmailAddress: Remove firstName, lastName, and "." Use employeeId only.

     • verifyFirstname: Change length check from 2 to 1 to allow single character Asian first names.

2. Edit the End User Anon Enrollment Completion form to remove the firstName and lastName arguments from calls to the getAccountId and getEmailAddress rules.

   ---

   Note –

   This library is displayed as the EndUserRuleLibrary library object in the Identity Manager IDE.

   ---

   Inputs:

   See EndUserRuleLibrary and EndUserRuleLibrary.

   You must specify the following for a custom EndUserLibrary rule:

   AuthType	EndUserLibrary
   SubType	Not specified

   The following table describes the example EndUserRuleLibrary rules.

   Rule	Input Variable	Description
   getCallerSession	None	Returns the internal session context (Lighthouse context) for the user executing a form.
   getUserView	resourceTargets list accountId string includeAvailableRoleInfos boolean	Returns the User view of the specified accountId, including a list of resource targets, and whether or not to include Role information.
   getView	nameOrId string type string options map	Returns a view of an object specified by the name or GUID, type of object, and a map of options.
   getUnassignedResources	roles list currentResources list groups list	Determines which resources are currently unassigned.
   getDirectReports	manager string options map	Returns a list of direct reports for a specified manager. For example, a list of users whose idmManager attribute is specified by the manager input variable.
   getIndirectReports	manager string options map	Returns a list of indirect reports for a specified manager. For example, a list of users who are in the reporting structure of the user specified by the manager input variable, excluding direct reports.
   getResourceObjectParentId	resourceName string resObjectName string objType string objAttr string	Returns a GenericObject of the parent of a resource specified by the name, object type, and object attribute.
   getObjectsByType	type string attributeVal string attributeName string	Returns a list of GenericObjects specified by type and that match the attributeName=attributeVal condition.
   getRealName	accountId string addAccountId boolean	Determines a user’s “real name,” such as FirstName <space> LastName, when an accountId has been provided. If the addAccountId argument is true, Identity Manager returns the FirstName LastName (accountId) string. If the FirstName or LastName attributes cannot be determined, the rule returns just the accountId. NOTES: You can easily modify this rule if you want the real name to display as LastName, FirstName. The user must have the appropriate permissions to be able to search for other users.

   The next table describes the example EndUserRuleLibrary rules used for anonymous enrollment.

   getAccountId	firstName string lastName string employeeId string	Generates an account ID from the first name, last name, and employee ID. First initial + last intial + employee ID Note: International users must modify this rule to ensure that Identity Manager maintains ASCII accountIds and email addresses during anonymous enrollment processing.
   getEmailAddress	firstName string lastName string emailDomain string	Generates an email address from the first name, last name, and email domain provided. firstname.lastname@emailDomain Note: International users must modify this rule to ensure that Identity Manager maintains ASCII accountIds and email addresses during anonymous enrollment processing.
   getIdmManager	employeeId string	Returns the account ID of the Identity Manager manager associated with an employee ID for a user being created. You must customize this rule for your deployment environment. (Default is configurator.)
   getOrganization	None	Returns the name of the organization to which a user will be assigned. You must customize this rule for your deployment environment. (Default is Top.)
   runValidation	None	Invokes verifyFirstname, verifyLastname, verifyEmployeeId, and verifyEligibility rules.
   verifyFirstname	firstName string	Validates the first name provided by a user for the End User Anonymous Enrollment process. This sample rule verifies a first name is not null. You must customize this rule for your deployment environment.  Note: International users must modify this rule to ensure that Identity Manager maintains ASCII accountIds and email addresses during anonymous enrollment processing.
   verifyLastname	lastName string	Validates the last name provided by a user for the End User Anonymous Enrollment process. This sample rule verifies a last name is not null. You must customize this rule for your deployment environment.
   verifyEmployeeId	employeeId string	Validates the employee ID provided by a user for the End User Anonymous Enrollment process. This sample rule verifies that an employee ID is valid. You must customize this rule for your deployment environment.
   verifyEligibility	firstName string lastName string employeeId string	Can be used to validate the employee ID provided by a user for the End User Anonymous Enrollment process. This rule must be customized for deployment.

ExcludedAccountsRule

The ExcludedAccountsRule supports the exclusion of resource accounts from resource operations.

Inputs:

Accepts the following arguments:

• accountId: String account ID being tested.

  You can compare the accountId argument to one or more resource accounts that should be excluded from Identity Manager.

• operation: Resource operation to be performed.

  The rule can use the operation argument to have finer control over which resource accounts are exempt from the actions specified by the operation parameter. If an operation parameter is not used within the rule, every account identified by the rule is excluded from all of the listed operations.

  The operation parameter can contain the following values:

  • create

  • update

  • delete

  • rename (used when the only detected change is a new account ID)

  • rename_with_update

  • list

  • iapi_create (only used within Active Sync)

  • iapi_update (only used within Active Sync)

  • iapi_delete (only used within Active Sync)

You must specify the following for a custom ExcludedAccountsRule rule:

The following example exemplifies subType use and excludes specified resource accounts for UNIX adapters.

Example 4–27 Exemplifying authType Use

<Rule name=’ExcludedResourceAccounts’ authType=’ExcludedAccountsRule’> 
   <RuleArgument name=’accountID’/> 
   <defvar name ’excludedList’> 
   <List> 
      <String>root</String> 
      <String>daemon</String> 
      <String>bin</String> 
      <String>sys</String> 
      <String>adm</String> 
      <String>uucp</String> 
      <String>nuucp</String> 
      <String>listen</String> 
      <String>lp</String> 
   </List> 
   <defvar>
      <cond> 
         <eq> 
            <contains> 
               <ref>excludedList</ref> 
               <ref>accountID</ref> 
            </contains> 
            <i>1</i> 
         </eq> 
         <Boolean>true</Boolean> 
      <Boolean>false</Boolean> 
      </cond> 
   </defvar>
</Rule>

The next example shows how to use the operation parameter. This parameter allows you to manipulate the “Test User” resource account— without impacting Identity Manager— if Active Sync is running against the resource.

Example 4–28 Example Using operation Parameter

<Rule name=’Example Excluded Resource Accounts’ authType=’ExcludedAccountsRule’> 
<!-- Exclude all operations on ’Administrator’ account Exclude activeSync events 
on ’Test User’ account --> 
   <RuleArgument name=’accountID’/> 
   <RuleArgument name=’operation’/> 
   <!-- List of IAPI Operations --> 
   <defvar name=’iapiOperations’> 
      <List> 
         <String>iapi_create</String> 
         <String>iapi_update</String> 
         <String>iapi_delete</String> 
      </List> 
   </defvar>
   <or> 
      <!-- Always ignore the administrator account. --> 
      <cond> 
         <eq> 
            <s>Administrator</s> 
            <ref>accountID</ref> 
         </eq> 
         <Boolean>true</Boolean> 
         <Boolean>false</Boolean> 
      </cond> 
      <!-- Ignore IAPI events for the ’Test User’ account --> 
      <and> 
         <cond> 
            <eq> 
               <contains> 
                  <ref>iapiOperations</ref> 
                  <ref>operation</ref> 
              </contains> 
              <i>1</i> 
            </eq> 
            <Boolean>true</Boolean> 
            <Boolean>false</Boolean> 
         </cond> 
         <cond> 
            <eq> 
               <ref>accountID</ref> 
                  <s>Test User</s> 
            </eq> 
            <Boolean>true</Boolean> 
            <Boolean>false</Boolean> 
         </cond> 
      </and>
    </or> 
</Rule>

This example shows an ExcludedAccountsRule for RACF.

Example 4–29 ExcludedAccountsRule for RACF

<Rule name="RACF EAR" authType="ExcludedAccountsRule"> 
   <RuleArgument name="accountID"/> 
   <block> 
      <defvar name="excludedList"> 
         <List> 
            <String>irrcerta</String> 
            <String>irrmulti</String> 
            <String>irrsitec</String> 
            <String>IBMUSER</String> 
         </List> 
      </defvar> 
      <cond> 
         <eq> 
            <containsAny> 
               <ref>excludedList</ref> 
               <list> 
                  <upcase> 
                     <ref>accountID</ref> 
                  </upcase> 
                  <ref>accountID</ref> 
               </list> 
            </containsAny> 
            <i>1</i> 
         </eq> 
      <Boolean>true</Boolean> 
      <Boolean>false</Boolean> 
      </cond> 
   </block> 
</Rule>

This final example shows an ExcludedAccountsRule for RACF LDAP.

Example 4–30 Excluded Accounts Rule for RACF LDAP

<Rule name="Test RACF_LDAP Case Insensitive Excluded Resource Accounts" 
authType="ExcludedAccountsRule"> 
   <RuleArgument name="accountID"/> 
   <block> 
      <defvar name="excludedList"> 
         <List> 
            <String>irrcerta</String> 
            <String>irrmulti</String> 
            <String>irrsitec</String> 
            <String>IBMUSER</String> 
         </List> 
      </defvar> 
      <defvar name="convertedId"> 
         <get> 
            <split> 
               <get> 
                  <split> 
                     <ref>accountID</ref> 
                     <s>,</s> 
                  </split> 
                  <i>0</i> 
               </get> 
               <s>=</s> 
            </split> 
            <i>1</i> 
         </get> 
      </defvar> 
      <cond> 
         <eq> 
            <containsAny> 
               <ref>excludedList</ref> 
               <list> 
                  <upcase> 
                     <ref>convertedId</ref> 
                  </upcase> 
               <ref>convertedId</ref>

getAvailableServerOptions

The getAvailableServerOptions rule determines the list of available server configuration options for the specified synchronization mechanism. Using the settings in Waveset.properties applies only for ActiveSync, and is a backwards-compatibility option.

Inputs:

Accepts the targetObjectType argument

If IDMXUser, then viaWavesetProperties is not returned in the list.

You must specify the following for a custom getAvailableServerOptions rule:

InsertDictionaryWord

Use the InsertDictionaryWord rule to run a JDBC command against the Identity Manager dictionary to load new words into the database.

Inputs:

Accepts the following arguments:

• type

• driverClass

• driverPrefix

• url

• host

• port

• database

• context

• user

• password

• sql

• arg1

• argList

You must specify the following for a custom InsertDictionaryWord rule:

IS_DELETE

The IS_DELETE rule is a sample rule, written for the PeopleSoft Active Sync adapter, that determines whether the Active Sync event should delete a user.

Inputs:

None

You must specify the following for a custom IS_DELETE rule:

Is Manager

The Is Manager rule tests specified accountIds to see whether they are managers for any other users in the system.

Inputs:

Accepts the managerId argument (<RuleArgument name=’managerId’/>)

You must specify the following for a custom Is Manager rule:

LoginCorrelationRules

The LoginCorrelationRules map user login information to an Identity Manager user. You specify logic in LoginCorrelationRules that enables the rule to search for an Identity Manager user and return a list of one or more AttributeConditions.

Inputs:

None

You must specify the following for a custom LoginCorrelationRules rule:

My Direct Reports

The My Direct Reports rule returns the names of all Identity Manager users that are direct reports of the caller. Management is typically a hierarchical structure, however this rule only returns the names of users that have the caller specified as their manager. The management hierarchy is not traversed by this rule.

Inputs:

None

You must specify the following for a custom My Direct Reports rule:

NamingRules Library

The NamingRules Library is a default library of rules that enable you to control how names are displayed after rule processing.

This library is displayed as the NamingRules library object in the Identity Manager IDE.

Inputs:

None

You must specify the following for a custom NamingRulesLibrary rule:

The following table lists the example NamingRules.

NewUsernameRules

The NewUsernameRule is a standard repository initialization file that you can use to extract the value of a user distinguished name’s (DN) left most relative distinguished name (RDN).

Inputs:

None

You must specify the following for a custom NewUsernameRules rule:

Object Approvers As Attestors

The Object Approvers As Attestors rule returns the provided objectapprovers parameter value if it is not null. If the objectapprovers list is not provided, this rule creates a new list and includes the Configurator user.

Inputs:

Accepts the following arguments:

• userEntitlement: View of a UserEntitlement object

• lhcontext: LighthouseContext of the caller

• objectowners: List of Identity Manager user names that are considered owners

• objectapprovers: List of Identity Manager user names that are considered approvers

You must specify the following for a custom Object Approvers As Attestors rule:

Object Owners As Attestors

The Object Approvers As Attestors rule returns the objectowners parameter if it is not null. If the objectowners list is not provided, the rule creates a new list and includes the Configurator user.

Inputs:

Accepts the following arguments:

• userEntitlement: View of a UserEntitlement object

• lhcontext: LighthouseContext of the caller

• objectowners: List of Identity Manager user names that are considered owners

• objectapprovers: List of Identity Manager user names that are considered approvers

You must specify the following for a custom Object Approvers As Attestors rule:

Organization Names

The Organization Names rule returns a List of Display Names for all organizations within the current context.

Inputs:

None

You must specify the following for a custom Organization Names rule:

OS400UserFormRules

Use the OS400UserFormRules to manage the default User Form values for an OS400 resource.

Inputs:

None

You must specify the following for a custom OS400UserFormRules rule:

The following table lists the example OS400UserFormRules.

RACFUserFormRules

Use the RACFUserFormRules to specify default settings for your RACF resource account.

Inputs:

None

You must specify the following for a custom RACFUserFormRules rule:

The following table lists the example RACFUserFormRules.

Reconciliation Rules

The following table provides information about the common Identity Manager processes or tasks related to the reconciliation rules category:

• Correlation Rule

• Confirmation Rule

Correlation Rule

Identity Manager invokes the Correlation rule during reconciliation to associate a resource account with one or more Identity Manager users.

Inputs:

Accepts a WSUser representing a resource account as returned by ResourceAdapter#getUser(WSUser)

You must specify the following for a custom Correlation rule:

account. LHS Attr Name

Confirmation Rule

Identity Manager invokes the Confirmation rule during reconciliation to compare a resource account with one or more Identity Manager users.

Inputs:

Accepts the following arguments:

• A WSUser representing an existing IDM user

• A WSUser representing a resource account as returned by ResourceAdapter#getUser(WSUser)

You must specify the following for a custom Confirmation rule:

RegionalConstants Library

The RegionalConstants Library is a default library of rules that enable you to control how states, days, months, countries, and provinces are displayed.

This library is displayed as the RegionalConstants Rules library object in the Identity Manager IDE.

Inputs:

See Table 4–9.

You must specify the following for a custom RegionalConstants Library rule:

The following table lists the example RegionalConstants rules.

Remediation Transaction Message

The Remediation Transaction Message rule is a default rule that is used to format the remediation or mitigation transaction text. You can customize this rule to provide more information for the user to sign.

Inputs:

Accepts the following arguments:

• workItemList: A set of workitems that are being approved.

• variablesList: A set of variables corresponding to each workitem in workitemList.

• approverName: User being asked to approve the workitems.

• action: Expected to be remediate or mitigate.

• Comments: Comments that are entered as part of the remediation.

• expiration: ISO date string for the remediation end date, which is needed only if the action is mitigate.

You must specify the following for a custom Remediation Transaction Message rule:

Remediation Transaction Message Helper

The Remediation Transaction Message Helper rule returns the formatted transaction text for the remediation or mitigation of a single workitem.

Inputs:

Accepts the following arguments:

• workItem: The workitem that is being approved.

• variables: The workitem variables.

You must specify the following for a custom Remediation Transaction Message Helper rule:

ResourceFormRules

The ResourceFormRules library is a default library of rules that enable you to customize values and choices used in several of the UserForms, which in turn are frequently used to select user attributes for resources.

Inputs:

See Table 4–10.

You must specify the following for a custom ResourceFormRules rule:

The following table describes the example ResourceFormRules.

Resource Names

The Resource Name rule returns a list of Resources within the current context.

Inputs:

None

You must specify the following for a custom Resource Names rule:

Role Approvers

The Role Approvers rule provides a list of users who are approvers for a specified role.

Inputs:

Accepts the roleName argument

You must specify the following for a custom Role Approvers rule:

Role Notifications

The Role Notifications rule provides a list of users who are designated to be notified when a role is assigned to a user.

Inputs:

Accepts the roleName argument

You must specify the following for a custom Role Notifications rule:

Role Owners

The Role Owners rule provides a list of users who are the owners of a specified role.

Inputs:

Accepts the roleName argument

You must specify the following for a custom Role Owners rule:

Sample On Local Network

The Sample On Local Network rule is an example of a LoginConstraintRule evaluated during login to determine if the login module group will be applied to the user login.

Inputs:

None

You must specify the following for a custom Sample On Local Network rule:

SAP Portal User Form Default Values

The SAP Portal User Form Default Values library is a default library of rules that provide default values for the SAP Portal User Form.

Inputs:

None

You must specify the following for a custom SAP Portal User Form Default Values rule:

The following table describes the example SAP Portal User Form Default Values.

ShellRules

The ShellRules library consists of one rule, called getDefaultShell. Multiple forms use the getDefaultShell rule to return the default shell for a particular Unix resourceType.

Inputs:

Accepts the resourceType argument.

The only valid resourceTypes are Solaris, AIX, HP-UX, and Red Hat Linux

Each resourceType must have the same default shell as specified in the ResourceAdapter.

You must specify the following for a custom ShellRules rule:

SIEBEL_NAV_RULE

The SIEBEL_NAV_RULE is a sample navigation rule that could be specified as the AdvancedNavRule, as discussed in the “Advanced Navigation” section of the Siebel CRM documentation.

Inputs:

None

You must specify the following for a custom SiebelNavigationRule:

TestDictionary

Use the TestDictionary rule to run a JDBC query against the Identity Manager dictionary to test the connection.

Inputs:

Accepts the following arguments:

• type

• driverClass

• driverPrefix

• url

• host

• port

• database

• context

• user

• password

• sql

• arg1

You must specify the following for a custom TestDictionary rule:

TopSecretUserFormRules

Use the TopSecretUserFormRules to specify default settings for your TopSecret resource account.

Inputs:

None

You must specify the following for a custom TopSecretUserFormRules rule:

The following table describes the example TopSecretUserFormRules.

User Members Rule

The User Members Rule enables you to dynamically control a single organization’s user membership, based on who is logged in. For example, if you assign the User Members Rule to the My Employees organization, the rule dynamically controls the organization’s user membership as follows:

• If Bob logs in and controls the My Employees organization, then Bob can only see and manage his employees in the My Employees organization.

• If Mary logs in and also controls the My Employees organization, she can only see and manage her employees. She cannot see or manage Bob’s or anyone else’s employees.

Inputs:

• User view of the authenticated admin user, context or Identity Manager session of authenticated administrator user

• userMemberRuleOrganizationDisplayName:The display name of an organization. (Optional)

• userMemberRuleOrganizationPathName:The full, colon delimited, organization path name. (Optional)

You must specify the following for a custom User Members Rule rule:

USER_EMAIL_MATCHES_ACCOUNT_EMAIL_CONF

The USER_EMAIL_MATCHES_ACCOUNT_EMAIL_CONF rule is a confirmation rule that compares an Identity Manager user to an account.

Inputs:

None

You must specify the following for a custom USER_EMAIL_MATCHES_ACCOUNT_EMAIL_CONF rule:

USER_EMAIL_MATCHES_ACCOUNT_EMAIL_CORR

The USER_EMAIL_MATCHES_ACCOUNT_EMAIL_CORR rule is a correlation rule that searches for a Identity Manager user with an email attribute value that matches the email attribute value in the specified account.

Inputs:

None

You must specify the following for a custom USER_EMAIL_MATCHES_ACCOUNT_EMAIL_CORR rule:

USER_FIRST_AND_LAST_NAMES_MATCH_ACCOUNT

The USER_FIRST_AND_LAST_NAMES_MATCH_ACCOUNT rule is a confirmation rule that compares an Identity Manager user to an account by looking for a fullname attribute.

Inputs:

None

You must specify the following for a custom USER_FIRST_AND_LAST_NAMES_MATCH_ACCOUNT rule:

USER_NAME_MATCHES_ACCOUNT_ID

The USER_NAME_MATCHES_ACCOUNT_ID rule is a correlation rule that searches for an Identity Manager user with the same name as the user in the specified account.

Inputs:

None

You must specify the following for a custom USER_NAME_MATCHES_ACCOUNT_ID rule:

USER_OWNS_MATCHING_ACCOUNT_ID

The USER_OWNS_MATCHING_ACCOUNT_ID rule is a correlation rule that searches for any Identity Manager user that owns an accountId matching the name of the specified account.

Inputs:

None

You must specify the following for a custom USER_OWNS_MATCHING_ACCOUNT_ID rule:

Users Without a Manager

The Users Without a Manager rule determines which Identity Manager users are administrators.

Inputs:

None

This rule uses the lhcontext variable from the calling scope.

You must specify the following for a custom Users Without a Manager rule:

Use SubjectDN Common Name

The Use SubjectDN Common Name rule to return a subject’s common name from the subject’s DN.

Inputs:

None

You must specify the following for a custom Use SubjectDN Common Name rule: