Overview

When you are creating Entitlement Policies, it's possible that the policies that affect a particular user might conflict in assigning entitlements to that user.

Here's how those conflicts are resolved. For some entitlements, you can change the conflict resolution.

• Entitlements that don't have values are additive. In most cases an account is an entitlement that doesn't have values. If a user is granted an account on a connected system by any Entitlement Policy, the user receives an account on that system. It does not matter whether another Entitlement Policy conflicts; the result is additive.

  This is always true; the method of conflict resolution for granting accounts cannot be changed.

  One metaphor for entitlements that don't have values is a light switch; it's either "on" or "off;" granted or not granted.

  For example, if the Manager Entitlement Policy grants Jean Chandler an Exchange account, but Jean Chandler is excluded from the Mail Room Employees Entitlement Policy that also grants Exchange accounts, Jean still gets an Exchange account.

• Entitlements that have values are additive by default, but you can choose to resolve by priority. These are entitlements such as group membership with a list of group names for the values, or an attribute with a value. By default, these kinds of entitlements are also additive.

  You can change the conflict resolution for these kinds of entitlements, if desired.

  The setting that governs conflict resolution for each entitlement type is in the driver manifest for a driver. Each kind of entitlement that a driver offers is listed separately in the manifest. Entitlements that have values have a conflict-resolution attribute, which is set for each entitlement independently. The default setting is conflict-resolution="union". The other possible value is conflict-resolution="priority".

  • conflict-resolution="union" --- A value of "union" means the entitlements are additive. A user is granted all the entitlements that he or she is assigned by membership in any policy. The differing entitlement values are simply added together and the user gets them all.

    For example, if Jameel is a member of the Trade Show Contractors Policy that grants membership in a GroupWise e-mail distribution list named Trade Show Mailing List, and he is excluded from membership in the Trade Show Managers Policy that also assigns the e-mail distribution list named Trade Show Mailing List, he will still receive membership in the e-mail distribution list.

    As another example, if Consuela is granted membership in the AD group named Mailroom Staff by the Mailroom Policy, and also granted membership in the AD group named Emergency Response by the Emergency Volunteers Policy, she is granted membership in both groups in AD.

    With this setting, the order of an Entitlement Policy in the list of policies is not important for the entitlement.

  • conflict-resolution="priority" --- By contrast, a value of "priority" means that if the values in two different policies conflict, or if one policy includes the user and another excludes the user, the entitlements granted to the user are only those in the Entitlement Policy that is listed higher in the list of Entitlement Policies.

    The previous examples would have a different result with this setting.

    In the example above for Jameel, if the GroupWise e-mail distribution list entitlement had a value of "priority," and the Trade Show Managers Policy was higher in the list than the Trade Show Contractors Policy, Jameel would not be granted membership in the Trade Show Mailing List.

    In the example above for Consuela, if the AD NOS group membership entitlement had a value of "priority," and the Mailroom Policy was higher in the list than the Emergency Volunteers Policy, Consuela would be granted membership in only the Mailroom Staff group. She would not be granted membership in the Emergency Response group because the conflict resolution is by priority, not additive.

    This functionality would be useful if, for example, you configured your environment to use Role-Based Entitlements to place users in a hierarchical structure on another system. You would want the user to be placed in either one place or another, not two places at the same time.

    Keep in mind that the setting is independent for each entitlement offered by each driver.

    As a general rule, if you use the "priority" setting, you should place administrator or manager policies higher in the list than policies for end users or individual contributors. You should put groups with narrower membership higher than groups with broader membership.

Changing the Conflict Resolution Method for an Individual Entitlement

1. In iManager, click DirXML Management > Overview, then select a driver set.

   A page appears with a graphical representation of all the drivers in the driver set.

2. Stop the driver.

3. Click the driver icon for the driver that offers the entitlement you want to change.

   A page appears showing icons for the driver's policies and the driver.

4. Click the driver icon to open the driver parameters page.

5. Click Driver Manifest.

   The driver manifest is displayed in XML, but it is dimmed because it is not in editable mode.

6. Select the check box for Enable XML editing.

7. In the XML, find the definition of the entitlement you want to change.

   Here's an example of the line you should look for:

   <entitlement conflict-resolution="union" description="Grants membership to GroupWise Distribution lists" display-name="GroupWise Distribution Lists" name="gwDistLists">

8. Change the conflict-resolution value. The two possible values are the following:

   conflict-resolution="union"

   conflict-resolution="priority"

   For information about these values, see Conflict Resolution between Entitlement Policies.

9. Restart the Entitlements Service driver.

Prioritizing Entitlement Policies

By default, the order of the list of Entitlement Policies does not matter. This is because the driver configurations shipped with Identity Manager 2 have conflict-resolution="union" as the method of conflict resolution for each entitlement.

If you change any of the entitlements to conflict-resolution="priority," then the order of the list of Entitlement Policies matters, but only for those entitlements you changed. For information about these values, see Conflict Resolution between Entitlement Policies.

You change the order of the Entitlement Policies by using the arrow buttons next to the list of Entitlement Policies. The policy first in the list is the highest priority.

1. In iManager, click Role-Based Entitlements > Role-Based Entitlements.

2. Search for and select a driver set.

   A page appears with a list of the Entitlement Policies.

3. Change the priority of the Entitlement Policies by using the arrow buttons to move the policies up and down in the list.

   Moving an Entitlement Policy higher in the list gives it a higher priority.

4. Click the Close button to restart the driver.

   Changes in priority don't take effect until the driver is restarted.

See the figure below for an example of the policy list page showing the arrow buttons. With the mouse over the Up arrow, the text "Adjust priority up" is displayed.