Directory Console 0.4.4

There's nothing to change in compose.yaml, and the configuration format is unchanged, so going back to 0.4.3 needs no restore. See UPGRADING.

Role-based entitlements

A driver set has a new Role-based entitlements tab for its entitlement policies (the Entitlements Service driver's RBE policies).

• The list: policies in priority order, what each grants (driver, entitlement and values) and who it covers (the membership query, static members, exclusions).
• A policy: its query and scope, the identity it searches as, exclusions, grants, and the members eDirectory computes for it.
• For operators:
  • Reorder: saved from the order you read, and refused if someone changed it meanwhile.
  • Delete: type the policy's name; the rest keep their order, renumbered without gaps.
  • Re-evaluate membership: restarts the Entitlements Service driver, which reads the policies only when it starts. After any change the tab prompts for this.
• Warnings: priorities the Entitlements Service driver would refuse (missing, repeated or with gaps) are flagged.

Checked on an Identity Manager 4.8.7 engine with test policies. The driver cached what the console wrote, and accepted its priorities after a reorder and after a delete.

Creating and editing policies comes next.

Fixes from comparing with Identity Console 26.1.2

• A group is never its own member. Adding a group to its own members or memberships is refused, from either side and for agents too.
• Cache events with unusual characters. The cache inspector removes characters XML does not allow (control characters) to show an event, and marks it "cleaned". An entry it still cannot read is listed as "unreadable" with its text, instead of ending the list.