Assigning Users to Organizations

Each user is a static member of one organization, and can be a dynamic member of more than one organization.

You define organizational memberships using either of the following methods:

• Direct (static) assignment. Select the Identity form tab on the Create User page or Edit User page to assign users directly to an organization. A user must be directly assigned to one organization.

• Rule-driven (dynamic) assignment. Use a User Members Rule that is assigned to an organization to assign users to that organization. The rule, when evaluated, returns a set of member users.

  Waveset evaluates the User Members Rule when:

  • Listing the users in an organization

  • Finding users (through the Find Users page) that includes searching for users that are in an organization with a User Members Rule

  • Requesting access to a user, provided that the current administrator controls an organization with a User Members Rule

For more information about creating and working with rules in Waveset, see Chapter 4, Working with Rules, in Oracle Waveset 8.1.1 Deployment Reference.

Select a User Members Rule from the User Members Rule menu on the Create Organization page. The following figure shows an example User Members Rule.

The following example illustrates the syntax for a sample User Members Rule used to dynamically control an organization’s user membership.

Before creating a User Members Rule, you should be aware of the following:

• For a rule to appear in the User Members Rule option box, its authType must be set as authType=’UserMembersRule’.

• The context is the currently authenticated Waveset user’s session.

• The defined variable (defvar) Team players gets the distinguished name (dn) for each user that is a member of the Windows Active Directory organization unit (ou) Pro Ball Team.

• For each user found, the append logic will concatenate the dn of each member user of the Pro Ball Team ou with the name of the Waveset Resource prefixed by a colon (as in :smith-AD).

• The results returned will be a list of dn’s concatenated with the Waveset resource name in the format dn:smith-AD.

Example 6–1 Sample User Members Rule

<Rule name=’Get Team Players’ authType=’UserMembersRule’>
  <defvar name=’Team players’>
    <block>
      <defvar name=’player names’>
        <list/>
      </defvar>
  <dolist name=’users’>
    <invoke class=’com.waveset.ui.FormUtil’ name=’getResourceObjects’>
      <ref>context</ref>
      <s>User</s>
      <s>singleton-AD</s>
      <map>
        <s>searchContext</s>
        <s>OU=Pro Ball Team,DC=dev-ad,DC=waveset,DC=com</s>
        <s>searchScope</s>
        <s>subtree</s>
        <s>searchAttrsToGet</s>
        <list>
          <s>distinguishedName</s> 
        </list> 
      </map> 
    </invoke> 
    <append name=’player names’> 
    <concat> 
      <get> 
        <ref>users</ref>
        <s>distinguishedName</s>
      </get>
        <s>:sampson-AD</s>
    </concat>
    </append> 
  </dolist> 
    <ref>player names</ref>
  </block>
   </defvar> 
    <ref>Team players</ref>
</Rule> 

You can configure several properties in Waveset. properties to control the rule-driven User Members list cache, which can affect memory and performance. For information, see Tracing Rule-Driven Members Caches in Oracle Waveset 8.1.1 System Administrator’s Guide.