This page (revision-1) was last changed on 29-Nov-2024 16:16 by UnknownAuthor

Only authorized users are allowed to rename pages.

Only authorized users are allowed to delete pages.

Page revision history

Version Date Modified Size Author Changes ... Change note

Page References

Incoming links Outgoing links
DirXML Entitlements
DirXML Entitlements

Version management

Difference between version and

At line 1 added 52 lines
!!! [DirXML Entitlements] [1]
Conceptually, [DirXML Entitlements] is a named flag that causes a DirXML driver configuration to perform some arbitrary action that is usually related to granting access to some resource in a connected system. Entitlements (as embodied in Role-based Entitlements) have thus far been used for three basic actions:
* Creating and deleting or enabling and disabling a connected-system account
* adding/removing connected-system accounts group memberships
* adding/setting attribute values to connected-system accounts
!! [DirXML-Entitlement] [ObjectClass]
An entitlement is embodied in an eDirectory [DirXML-Entitlement|2.16.840.1.113719.1.14.6.1.2023] [ObjectClass], which is contained by a [DirXML-Driver] object. The containment of the [DirXML-Entitlement|2.16.840.1.113719.1.14.6.1.2023] [ObjectClass] establishes the correspondence between the entitlement and the implementing DirXML driver configuration. The DirXML-Entitlement object's name is the name of the entitlement.
The XmlData attribute of the [DirXML-Entitlement|2.16.840.1.113719.1.14.6.1.2023] [ObjectClass] contains an XML document whose root element is <entitlement>. We have some more [detailed information|Description-2.16.840.1.113719.1.14.6.1.2023] on how the XML structure is defined.
!! Granting and Revoking Entitlement ([DirXML-EntitlementRef|DirXML-EntitlementRef])
An entitlement is granted to and revoked from an eDirectory entry via the addition a value for the [DirXML-EntitlementRef|DirXML-EntitlementRef] attribute which is associated with the auxiliary class [DirXML-EntitlementRecipient|2.16.840.1.113719.1.14.6.1.2024] on an eDirectory entry.
The [DirXML-EntitlementRef|DirXML-EntitlementRef] attribute is of [SYN_PATH|2.16.840.1.113719.1.1.5.1.15] syntax and is [write-managed].
! Volume Element
The "volume" (or DN) portion of the path syntax value refers to the [DirXML-Entitlement] object. Because the attribute is write-managed, the agent setting the [DirXML-EntitlementRef] attribute value on an eDirectory object must have write access to the [DirXML-EntitlementRef|DirXML-EntitlementRef] attribute on the object that is being written to and must also have write access to the ACL attribute on the [DirXML-Entitlement] object that is referred to by the DN portion of the [DirXML-EntitlementRef|DirXML-EntitlementRef] value.
! Path Element
The "path" (or string) portion of the [DirXML-EntitlementRef|DirXML-EntitlementRef] attribute contains an XML document whose root element is <ref>.
! namespace Element
The "namespace" (or integer) portion of the [DirXML-EntitlementRef|DirXML-EntitlementRef] attribute is used as a [bitmask] to hold a set of flags.
Bit 0 of the 32-bit integer is used for this flag value and is known as the state bit where:
* 0 means revoked
* 1 means granted
Bit 1 is used to flag a granted entitlement that is the result of the upgrade process and is known as the upgrade bit where:
* 1 means that the entitlement was previously granted in the legacy format and is therefore not a change in the entitlement state.
Bits 2-31 are reserved for future use.
! [DirXML-EntitlementResult|Description of Attribute Usage For 2.16.840.1.113719.1.14.4.1.2088] attribute
After the entitlement action (grant or revocation) has been completed (successfully or not) by the DirXML driver configuration, a result is written to the eDirectory object using the [DirXML-EntitlementResult|Description of Attribute Usage For 2.16.840.1.113719.1.14.4.1.2088] attribute. [DirXML-EntitlementResult|Description of Attribute Usage For 2.16.840.1.113719.1.14.4.1.2088] is a multi-valued [SYN_OCTET_STRING|1.3.6.1.4.1.1466.115.121.1.40] containing an XML document whose root element is <result>.
!! [Implementing Novell Entitlements in a Driver]
Some information on [Implementing Novell Entitlements in a Driver]
!! [Removing Novell Granted Entitlements]
We did some work where it was desired to ["revoke" all granted" entitlements|Removing Novell Granted Entitlements] when various events took place on a user.
!! Entitlements and romResources
DirXML Entitlements are often encapsulates within a [romResource] for convenience.
!! More Information
There might be more information for this subject on one of the following:
[{ReferringPagesPlugin before='*' after='\n' }]
----
[#1] [http://developer.novell.com/documentation/dirxml/dirxmlbk/ref/dirxmlentitlements/index.html]
This page (revision-1) was last changed on 29-Nov-2024 16:16 by UnknownAuthorTop