NetIQ Documentation: Identity Manager 4.0.2 Entitlements Guide - Understanding Identity Manager 4.0 and Later Entitlement Formats

1.5 Understanding Identity Manager 4.0 and Later Entitlement Formats

For Identity Manager 4.0 and later, the entitlement value is multivalued. The format of storing the entitlement parameter has changed. The new entitlement parameters are formatted as a JSON string as follows:

{"ID":"aspencer-cell"}

Using JSON string allows the use of name=value pairs and to introduce the concept of well-known fields where the same type of information can be stored using the same identifier and can be retrieved easily by consuming application (for example, Role-Based Provisioning Module, Role Mapping Administrator, Identity Reporting Module). JSON also addresses the issue of escaping special characters in values. JSON is a well-known format and there are many JSON parsers and generators available for use. Table 1-1 lists mandatory fields for JSON.

Table 1-1 Mandatory Fields for JSON

ID	Display Name	Sample Value	Mandatory	Description
ID	Primary ID	f1e84f2a7964614eaa45407c724e3a98	Yes	The Identity Manager drivers use the primary ID to identify the corresponding entity in the connected system. For example, the Active Directory driver uses the objectGUID in Active Directory as the identifier. However, the GUID is not of any value to other applications.
ID2	Secondary ID	CN=Domain Users,CN=Users,DC=yourcompany,DC=msft	No	The Identity Manager drivers can use the secondary ID to identify the corresponding entity in the connected system. This ID is not used by Identity Manager but might provide value to other consuming applications of the entitlement. Active Directory can identify an object by its objectGUID but also by its DN. DN is a valuable secondary ID for Active Directory entitlements.
LIID	Logical Instance ID	S7ICLNT800	No	The fan-out drivers can use the Logical Instance ID to know if the entitlement is granted to the logical instance of the application they connect to.

You can add more fields if entitlements require additional fields. For example, adding validity dates (valid from and valid to) or other. The names of the new fields must start with an underscore “_” as shown in Table 1-2.

Table 1-2 Optional Fields for JSON

ID	Display Name	Sample Value	Mandatory	Description
_FROM	Valid From	20100318	No	A sample custom field the SAP User Management driver uses for role entitlements.
_TO	Valid To	20100319	No	A sample custom field the SAP User Management driver uses for role entitlements.

1.5.1 Entitlement Parameters

The following are examples of entitlement parameters for Identity Manager drivers:

Active Directory driver:

  {
    "ID": "f1e84f2a7964614eaa45407c724e3a98",
    "ID2": "CN=Domain Users,CN=Users,DC=yourcompany,DC=msft"
  }

SAP User driver:

 {
    "ID": "A_BEW_ALL",
    "LIID": "S7ICLNT800",
    "_FROM": "20100318",
    "_TO": "20100319"
 }