Skip to main content

Example: Configure group entitlement attributes

In Example: Updating group attributes , you learned how to update a resource attribute that was mapped to a group attribute on Active Directory. Resource attributes can also be configured as entitlement attributes to define the relationship between two resources.

The built-in ENTITLEMENT_EXPIRY_DATE attribute can be used to trigger an event to complete an action; for example, when a member’s expiry date arrives, an email is sent to prompt the removal of that user from the group.

In this example, we add a resource attribute group so that users can set this expiry date in a pre-defined request.

Assumptions

This example assumes:

  • Bravura Workforce Pattern is installed.

  • The "AD" Active Directory target system is configured as a source of profiles.

  • Group owners in AD are configured as group managers in Bravura Identity .

Click below to view a demonstration of this example.

Add a resource attribute group

  1. Log in to the Bravura Security Fabric Front-end (PSF) as superuser .

  2. Click Manage the system > Resources > Resource attribute groups.

  3. Click Add new… .

  4. Enter the following information:

    • ID Group_entitlements_attrs

    • Description Group entitlement attributes

    • Resource type Account group memberships

    lab-groups-ent-add

  5. Click Add.

  6. Click the Access control tab.

  7. Select "Allow read" and "Allow write" for ALLUSERS.

  8. Click Update.

  9. Click the Members tab.

  10. Click Select… .

  11. Select "ENTITLEMENT_EXPIRY_DATE".

  12. Click Select .

  13. Click the Display criteria tab.

  14. Ensure the Display type is set to "Main".

  15. Click Update.

We have now configured the ENTITLEMENT_EXPIRY_DATE attribute so that it can be updated by users. In the next example, we will configure the _GROUP_CREATE_ pre-defined request to include the ability to set an expiry date for each group member.

In this section: