member-assignment-query

The <member-assignment-query> are only applicable for <entitlement> type account. The IDM Data Collection Service (DCS) has the requirement to be able to obtain member assignment information from managed and unmanaged accounts. Because member assignment information can be bulky (groups and roles can potentially have many assigned members), the query extensions to retrieve this information are optional and have to be added by the querying agent on an as-needed basis. Member assignment information is available on both account and group entitlements but it has to be retrieved slightly differently. For entitlement with type name "account" the content of the query-xml child node of the member-assignment-query node is expected to be a full query definition and replaces the potentially existing query defined in the entitlement XML.

Example

<member-assignment-query>
	<query-attr name="query-type">entitlement-assignment</query-attr>
	<query-xml>
		<nds dtdversion="2.0">
			<input>
				<query class-name="User" scope="subtree">
					<search-class class-name="User"/>
					<read-attr/>
				</query>
			</input>
		</nds>
	</query-xml>
</member-assignment-query>