Skip to main content
Skip table of contents

Object Lifecycle Policies

Definition

An Object Lifecycle Policy allows to configure rules, on all Object Types, that will alter an Object attribute directly when certain lifecycle events occur.
This can be:

  • when creating an Object

  • when assigning Roles or Rights on Identities

  • when deactivating an Object

  • when updating the status of Object

  • when freezing a Role Assignment (it cannot be changed by automatic processes, the Role Assignment end date is ignored, as well as Role Assignment Policies that might remove it).

Those changes must be performed in the same operation as the one that triggered the lifecycle event.

There is a Lifecycle control that is split into stages. The Object Lifecycle Policies can introduce behavior between those stages.

Those Lifecycle Policies are similar to Object Policies, however the Groovy script allows to directly manipulate the Attributes of the Object.

Usage

We want to configure an Object Lifecycle Policy that will freeze Role Assignment by setting a freeze ending date on it.
In this case, the Role Assignment is frozen when the security organization of the Identity is updating.
When the Role Assignment is frozen, it is not possible to perform modification or to delete it.
To unfreeze the Role Assignment, you must update the date of the frozen until Attribute (by API or by configuring in the Groovy script).

Steps

Preview

1

Configure an Object Lifecycle Policy that will freeze a Role Assignment.

ObjectLifecyclePolicy.xml

2

Assign a Role to an Identity.

3

Update the security organization of the Identity.
Wait until the configured delay in the Object Lifecycle Policy has passed.
Access the Role dashboard of the Identity.
A snowflake is displayed on the line of the assigned Role and the date of frozen until is displayed when clicking on the "Action" button.

Configuration

You can access the Object Lifecycle Policy configuration :

  • by clicking on "Policies" → “Object Lifecycle Policy”

  • by clicking on "System" → "Configurations" → "Data Model" and perform an import/export.

Properties

Object Lifecycle Policy

Properties name

Type

Mandatory

Description

Values (default value in bold)

id

String

YES

The identifier is the unique identifier of the Object Lifecycle Policy.

It is case sensitive and no special characters (except - or _) are allowed.

-

name

String

YES

The Object Lifecycle Policy name.

The name may be different from the identifier.Specifying the name first allows to define automatically the identifier.
Must be at least 4 characters long.

-

active

Boolean

NO

Allows to define if the Object Lifecycle Policy is activated or not.

ON, OFF

description

String

NO

Allows to describe the purpose of the Object Lifecycle Policy.

-

objectKind

Enum

YES

Allows to link the Object Lifecycle Policy to an Object kind.
The Policy will apply to this Object kind.

Identity, Organization, Resource, Role, Role Publication

objectTypes

Enum

NO

Allows to choose on which Objects the Object Lifecycle Policy will be applied.

List of created Object Types

stage

Enum

YES

Allows to choose stage according to the configured Object kind.

Before common stage, After common stage, Before assignments stage, After assignments stage, Before authentication methods stage, After authentication methods stage, Before inheritance stage, After inheritance stage, Before finalize stage, After finalize stage

rules

Groovy script

YES

Allows to configure Transform rules by Groovy script.

-

Stage

Stage

Object kind

Description

Before common stage
After common stage

All

Allows to manage the Object Lifecycle:

  • handling "enable" attribute: changes authorization, activation modes, enable from/until)

  • creation, update, deletion dates in metadata

  • sanity checks on current operation

Before assignments stage
After assignments stage

Identity

Allows to manage the Roles and Rights hierarchy update:

  • computing the dimensions in Role and Rights

  • applying Role Assignment Policies

  • updating Role status

Before refresh orders stage
After refresh orders stage

Role

Allows to manage the generation of refresh orders for Roles and Role Assignment Policy changes, when necessary.

Before inheritance stage
After inheritance stage

Organization

Allows to manage the mechanisms related to inheritance in Objects that are organized as a hierarchy:

  • inheritance of Attirbutes

  • setting or hierarchy path

Before authentication methods stage
After authentication methods stage

Identity

Allows to manage the mechanisms related to Authentication Methods:

  • activation and deactivation of methods

  • triggering of automated actions if necessary

Before finalize stage
After finalize stage

All

Allows to manage the last minute operations.
Can be used by Object Lifecycle Policies to appli behavior a the very last moment.

Read Next

Business Policies — A Business Policy allows to configure how to trigger actions on Object Types through a Feature with an optional configured Workflow.
Object Policies — An Object Policy is an Identity Management Service Policy allowing to execute arbitrary actions on Managed Objects, either on a scheduled basis, or in reaction to an Object Operation.
Deduplication Policies — A Deduplication Policy describes how duplicates should be searched for when creating a managed object.
Feature Access Policies — A Feature Access Policy is composed of a right which encompasses several Features.
Manual Provisioning Policies — A Manual Provisioning Policy allows to define that manual provisioning or deprovisioning Workflow is launched when the Role assignment status changes.
Object Lifecycle Policies — An Object Lifecycle Policy allows to configure rules, on all Object Types, that will alter an Object attribute directly when certain lifecycle events occur.
Password Policies — A Password Policy determines how passwords should be composed and which rules apply to their lifecycle.
Role Request Policies — A Role Request Policy allows to define if a Role can be requested, for whom, by whom, and using which Workflow.
Workflow Administration Policies — A Workflow Administration Policy is composed of a right which encompasses several Features.
Memority MFA Account Policies — A Memority MFA Policy allows to configure how multi factor authentication should be applied to a population of user
JavaScript errors detected

Please note, these errors can depend on your browser setup.

If this problem persists, please contact our support.

Contact Support Close