adding priveleges to roles using amadmin

i found the answer for this one. Add this to your xml data file

<OrganizationRequests DN="dc=iplanet,dc=com">

<CreatePolicy

createDN="o=sunamhiddenrealmdelegationservicepermissions,ou=services,dc=iplanet ,dc=com">

<Policy name="DataStoreReadyPolicy" referralPolicy="false"

active="true">

<Rule name="delegation-rule">

<ServiceName name="sunAMDelegationService" />

<ResourceName

name="sms://*dc=myretsu,dc=com/sunIdentityRepositoryService/*/" />

<AttributeValuePair>

<Attribute name="READ" />

<Value>allow</Value>

</AttributeValuePair>

</Rule>

<Subjects name="ReadyOnlySubjects" description="">

<Subject name="delegation-subject"

type="AMIdentitySubject" includeType="inclusive">

<AttributeValuePair>

<Attribute name="Values" />

<Value>

id=employee,ou=role,dc=myretsu,dc=com,amsdkdn=cn=employee,dc=iplanet,dc=com

</Value>

<Value>

id=manager,ou=role,dc=myretsu,dc=com,amsdkdn=cn=manager,dc=iplanet,dc=com

</Value>

</AttributeValuePair>

</Subject>

</Subjects>

</Policy>

</CreatePolicy>

</OrganizationRequests>

raviph3 at 2007-7-6 21:56:36 >