Skip to content

Directory Console 0.4.5

Choose a tag to compare

View all tags
@jcombs-pointblue jcombs-pointblue released this 02 Nov 22:29
· 2 commits to main since this release
v0.4.5
06477b9

There's nothing to change in compose.yaml, and the configuration format is unchanged, so going back to 0.4.4 needs no restore. See UPGRADING.

Create and change role-based entitlement policies

The driver set's Role-based entitlements tab now edits policies. Use New policy on the tab, or Change in a policy's view.

  • Who it covers:
    • A query: a container, a scope, and a filter built or typed. Test the query shows who it finds now.
    • Search as: the identity eDirectory computes the members as. A new policy uses the set's Entitlements Service driver; another object, or nobody, can be chosen.
    • Static members, and exclusions.
  • What it grants: the entitlements the set's drivers define, with values where they take them, picked from a list or typed.
  • Rights to other objects: objects the policy is a trustee of. Its members get those rights, being security-equivalent to it. eDirectory can't search ACLs by trustee, so Find its rights reads the ACLs under a container you choose.
  • Still editable elsewhere: policies are saved as Designer and Identity Console write them, so either can still edit them.

What the Entitlements Service driver needs

Checked on an Identity Manager 4.8.7 engine with test policies the console wrote. The driver granted and revoked through them, and showed:

  • Every policy needs a query. One without makes the driver fail for everyone. A policy of static members only now gets a query that matches nobody, shown as "static members only".
  • Deleting a policy doesn't revoke what it granted: the driver ignores deletions. Delete now offers Remove everyone first, and the driver revokes as people leave. Deleting a policy that still covers people is refused unless forced, with a warning that its grants stay.
  • A restart doesn't re-evaluate anyone. The driver reads the policies when it starts, then grants and revokes person by person as something that decides membership changes. The tab's button is now Restart, not "Re-evaluate membership".
  • Changing a policy's query stops the driver until it's restarted; the tab asks for that.

Not yet confirmed on a real engine

  • Granting through a query: the test tree computed no members for a query policy.
  • Members receiving a policy's rights to other objects: this was not observed, as it needs signing in as a member.
Assets 6
Loading