Roles Setting and Removing Resource Attributes
Hello All,
I have a quick question (Which I hope has a quick answer). I am trying to set up a role, so that when it is assigned to a user, sets an attribute value on an LDAP resource. Then, when the role is removed from the user, the attribute value is cleared. When setting up the role, I specified the resource as assigned, and then set the attribute. When I set the role on a user, it is successfully setting the value in the attribute. When I remove the role from the user, it is not removing the value in the attribute. Is there an easy way to do this?
Thanks!
[584 byte] By [
JimBearda] at [2007-11-26 13:42:51]

# 1
Hi,
When setting the RoleAttribute you need to set "Authoritive Set to Value, Clear Existing", then when the Role is removed from the user the attribute value is deprovisioned. Unfortunately this also has the affect of removing any other value that the attribute may have (especially true since many LDAP attributes are multi-valued).
HTH,
Paul Walker
# 4
OK.. Thats not 100% true. I get the desired behavior that I want as long as I assign a default value in case no value should be set. IDM handles removing the old value as long as there are more values in the attribute. It won't remove the last value.
It handles it fine if you set a default value for the field.