Context Based Role Assignment

[martin_voros]

Hi,

I am trying to set up context based roles for scenario where I have multiple stores. I created a new entry type STORE that is used for context based assignment. I have a role ROLE:STORE:MANAGER that uses STORE as context attribute. This role will have privileges with different conditional contexts. For example

Privilege Name; Conditional Context

PRIV:ERP:STORE_MANAGER_1000;1000

PRIV:ERP:STORE_MANAGER_2000;2000

I also created a guided task that allows to select a store and assign role ROLE:STORE:MANAGER to user. When I select a context/store only privileges with same conditional context types are assigned. This should be working and my problem is related to visibility after assignment.

For example I assigned ROLE:STORE:MANAGER with context/store 1000 for validity period 24/11 - 30/11. I also assigned ROLE:STORE:MANAGER with context/store 2000 for validity period 24/11 - 31/12. Now when I display roles assigned to users I can see two lines for role ROLE:STORE:MANAGER with two different validity periods but there is no context displayed for each record. I guess I could see this based on assigned privileges.

I also checked internal representation and I can see that attribute MX_CTX is used to hold all contexts during assignment in MX_PENDING_VALUE object. But it seems like this value is lost after assignment. Is this right? Or can I see somewhere context that was used for role assignment? Maybe I am just missing some basic stuff but context based role assignments seem much less useful to me without visibility of context used for role assignment.

Thanks

[martin_voros]

I fixed this one. On entry definition of MX_PERSON on attribute MXREF_MX_ROLE you can tick check box "Context" and that will cause displaying context in UI. This flag is available only for roles and privileges.

[Former Member]

Also suggest that you have a look at the MX_ASSIGNMENT attribute on the user, for use in the WebUI. This attribute will allow you to see both role and privilege assignments in a WebUI task. This also has the "context" setting as you mentioned.

Regards

John Erik Setsaas

Development Architect IdM