Generate and Activate the Role Model

Role Model tutorial · Step 2 of 2

Generate department-based roles, verify memberships, and activate the model.

Use a role generator to build and maintain the role model for the AD groups provisioned in step 1.

A role generator takes two filters as input. These two filters are the most important parts of a role generator, and must be configured in a specific way:

• The Role Generation Filter is used to determine the roles that a role generator generates.
• The Role Member Filter is used to determine which target accounts will become members of which roles.

Select the role generation filter

We don't need to create a new filter for our Role Generation Filter, because we can use the include lookup on the HR500_AD_Group_Create filter we already created.

Create the role member filter

1. Go to Processing > Filters.
2. Click Add.
3. Enter a Filter Name. For this example, we'll name it HR500_AD_RoleMembers, following the convention Source_System_TargetSystem_RoleMembers.
4. Click Create.
5. In this filter, we need employees by department, joined to their AD user accounts. We'll do this by joining HR500.contracts to HR500.departments and AD.Users .
6. Parameterize HR500.departments.organizational_unit so a single filter can return employees for any department.

   1. In Parameters, add deptName with type input, data type string, and default value EN_DOC.

      tip

      The default department is only for previewing results. During generation, NIM passes each needed department through the parameter.

7. On our with any HR500.departments filter item, we'll click Expression filter item to add an expression item.
8. We'll set it to with organizational_unit equals .
9. For the new expression item, click Constant/Parameter to change the expression item from a constant to a parameter.
10. Set the parameter dropdown to deptName .
11. Go back to the Data tab.
12. Click Filter to test the parameterization. Only the 17 employees in the department EN_DOC are returned.
13. Click Save.

Create a development role model

Before we can create a role generator, we need to create a development role model for the generator to work on.

The development role model is the role model you work on, prior to activating it (i.e., putting it into production).

1. Go to Output > Roles.
2. On the Role Models tab, click Add to create a new development role model.
3. In the dialog box, click Yes to confirm.
4. A new development role model is created.

Configure the role generator

1. Go to the Role Generation tab.
2. Click Add.
3. Enter a Role Generator Name. For this example, we'll call it rg_AD, following the convention rg_TargetSystem.
4. Click Create.
5. For the Role Generation Filter, select the HR500_AD_Group_Create[group_include] filter we created earlier.
6. For the Role Name Column, select the column of the Role Generation Filter which contains the names of the roles to be generated. For this example, we'll select the organizational_unit column.
7. For the Role Member Filter, select the HR500_AD_RoleMembers filter we created earlier.
8. Set Member Filter Param Value to organizational_unit. NIM passes each department from the role-generation filter into the role-member filter to find the right accounts.
9. In the Role Groups pane, select the Enabled checkbox for the AD system.
10. Click Save.
11. Go to the Members tab.
12. Click Calculate to preview all role memberships.
13. Go to the Run tab.
14. Click Calculate to preview all role & group operations that will be performed.
15. Click Apply Generator to execute the role generator. The development role model is populated with the generated roles and groups.

Verify generated roles and memberships

• To verify the roles we generated and their members, go to Output > Roles and click Edit Role Model for the development role model. All generated roles are displayed.
  1. Click Group Membership Reports.
  2. Click Evaluate to ensure the report is up to date.
  3. Click a member, role, or group to see the other objects it's associated with. Click a role to see its groups and members. Click a group to see its roles and members. Or click a member to see its roles and groups. For example, here we are viewing the members and groups of the EN_HRTEAM role.

Activate the role model

To stage our roles for production, we need to activate our development role model.

1. Go to Output > Roles.
2. For the current development role model, click Activate Development Role Model.
3. In the dialog box, click Yes to confirm.
4. The development role model is now the active role model.

Add membership updates to the job

1. Go to Output > Jobs.
2. For the HR500_AD job, click Edit Job.
3. Go to the Configuration tab.
4. Click Add.
5. For this job item, select groupmembership for Type, then select AD for Name. Set the Threshold to 10000. For this operation, the threshold is the number of individual membership additions and removals, not the number of AD groups with changes.
6. Click Save.
7. Go to the Execution tab.
8. Click Evaluate. This example has 39 AD groups with updates and 793 individual membership changes. The groupmembership threshold is evaluated against the 793 membership changes, not the 39 groups.

Run the scheduled workflow

1. Go back to Scheduler > Overview.
2. Click Manual Run for the HR500 schedule.
3. Ideally, the schedule executes successfully, and all group memberships specified in the role model are assigned in AD.