do-remove-resource

Initiates a request to the Roles Based Provisioning Module (RBPM) to revoke the Resource specified by resource-id from an Identity.

Remarks

The target Identity is specified by either <arg-dn> or <arg-association> if specified or by the current object otherwise. If specified by <arg-dn>, the DN must be in the LDAP format. The request is made to the RBPM enabled User Application server specified by url using credentials specified by id and <arg-password>. Additional optional arguments to the Resource assignment request might be specified by the following named <arg-string>s.

Name

Description

description

A description of the reason for the request used for auditing and (if necessary) approval purposes.

Default: Request generated by policy.

If any type of error occurs while requesting the resource assignment, the error string is available to the enclosing policy in the local variable named error.do-remove-resource. Otherwise that local variable is not available.

Example

<do-remove-resource
    id="CN=UAAdmin,OU=Sa,O=Data"
  url="http://localhost:8080/IDMProv"
  resource-id="CN=Computer,CN=ResourceDefs,CN=RoleConfig,CN=AppConfig,CN=UserApplication,CN=DriverSet,O=System"
  time-out="5000">
  <arg-password>
    <token-named-password name="resource-admin"/>
  </arg-password>
  <arg-string name="description">
    <token-text>Requested by policy because requireComputer set to false</token-text>
  </arg-string>
</do-remove-resource>

Allowed Content

Element

Description

arg-password

Password argument.

arg-dn

DN argument.

arg-association

Association argument.

arg-string

String argument.

Attributes

Attribute

Possible Values

Default Value

disabled

true | false

True if this element is disabled.

false

id

CDATA

The LDAP format DN of a user authorized to make the request. Supports variable expansion.

#REQUIRED

instance-guid

CDATA

The instance guid for revoking a single instance of a multivalued resource assignment. If null is specified, all instances are revoked. Supports variable expansion.

null

notrace

true | false

True if this element should not be traced during execution of the policy.

false

requester-id

CDATA

The LDAP format DN of a user who makes the request. Supports variable expansion.

#REQUIRED

resource-id

CDATA

The LDAP format DN of the Resource to revoke. Supports variable expansion.

#REQUIRED

time-out

CDATA

The number of milliseconds you want Identity Manager to try to establish a connection to the User Application server before timing out. Supports variable expansion.

0

url

CDATA

The URL of the User Application server hosting the Roles Based Provisioning Module. Supports variable expansion.

#REQUIRED

Content Rule

( arg-password, (arg-dn | arg-association ) ? , arg-string * )

Parent Elements

Element

Description

actions

Actions that are performed by a <rule>.

arg-actions

Association argument.