Previous Topic: Passwords for Accounts Created by Provisioning Roles

Next Topic: Enable Provisioning Role Membership Event Accumulation


Provisioning Role Event Processing Order

Some default CA IdentityMinder tasks include events, actions that CA IdentityMinder performs to complete a task, that determines provisioning role membership. For example, the default Modify User task includes the AssignProvisioningRoleEvent and the RevokeProvisioningRoleEvent. Assigning or revoking a provisioning role may add or remove an account on an endpoint. In some cases, the endpoint may require that all Add actions occur before Remove actions.

To make CA IdentityMinder process Add actions first, you enable the Accumulation of Provisioning Role Membership Events setting in the Management Console. When this setting is enabled, CA IdentityMinder accumulates all of the Add and Remove actions into a single event, called the AccumulatedProvisioningRolesEvent. For example, if the Modify User task assigns a user to three provisioning roles and removes that user from two other provisioning roles, an AccumulatedProvisioningRolesEvent will be generated which contains five actions: 3 Add actions and 2 remove actions.

When this event executes, all Add actions are combined into a single operation and sent to the Provisioning Server for processing. Once processing of the Add actions completes, CA IdentityMinder combines the Remove actions into a single operation and sends that operation to the Provisioning Server.

Enabling this setting affects the following CA IdentityMinder functionality: