How to dynamically resolve Service object approvals?

Discussion created by Sagi_Gabay Employee on Apr 27, 2015

An interesting use-case:


How can you dynamically associate approvers to approve Service objects for Identity Manager?


Well... If you wanted to use the Dynamic Resolver then you can only use the 'Group Member' function there for this resolution. The other function 'list of users' can not work. Here is why:


The dynamic resolver calls for an attribute that is associated with the object for approval. If the function is 'list of users' then it will require that being a multivalued attribute then it will automaitcally parse the values. If a 'Group Member' function is selected then it will assume the designated attribute is a single-valued attribute that holds the group's name.


Now, if approving users then there is no problem to use the 'list of users' as long as you define a multi-valued attribute. You need to specify an attribute in your dir xml and make sure it's multi-valued and then you can use it and all will work. For a Service object, however, this won't work. Service objects are not persisted in the directory and they have no dir xml representation and so you can't customize or extend them. Furthermore, there is a no out of the box multi-level attribute that's part of the Service object that you can use. Therefore there aren't any multi-valued attributes and the 'list of users' function can't be used.


You can still achieve a dynamic resolution for a Service object by using a Group Member function, designating a single valued attribute that belongs to your Service and providing the name of that group. This group's members will now become the approvers.





Sagi Gabay

CA Technologies