This is not the latest version of Identity Director documentation.View available documentation.
Qualification tab of the service page
In the Management Portal at Entitlement Catalog, use the Qualification tab on the service page to configure the qualification criteria of the service.
Criteria
Specify which criteria a person must meet to qualify for the service. You can assign people directly using their attributes or via their organizational context.
- If you assign organizational context, you can include subitems by selecting Include subitems. Organizational context that includes subitems is marked with \* in the Criteria section (for example Departments\*).
For example, if the organizational context item Locations contains the subitems New York and London, select Include subitems to include both subitems: this means that people who are classified in these subitems also qualify for the service. If you clear this option, only people who are classified in Locations qualify for the service; not the ones classified in New York and London.- Qualification is based on the first match with a person who is classified within the specified organizational context item (for example, in Departments\* the qualification is based on the first match with a person who is classified in Departments).
- If you assign multiple persons and organizational context, people must meet all criteria to qualify for the service (e.g. if you assign the organizational context items HR department and Managers, people must be classified in both to qualify).
- Click the arrows to change the order of items.
- Click Insert OR to create sets of criteria. This is useful if you want the service to apply to different roles or locations.Using criteria in multiple sets
You can use a single criterion in multiple sets of criteria.
For example (Departments\Engineering AND Locations\New York) OR (Departments\Engineering AND Locations\London).
To do this:- Using Add organization, add Locations\New York and Locations\London.
- Insert OR in between these two organizations
- Select one of the organizations and use Add organization to add Departments\Engineering.
- Select the other organization and use Add organization to add Departments\Engineering.
- Click NOT to exclude persons and/or organizational context from qualification.
- Select No one qualifies or Everyone qualifies to overrule persons and/or organizational context who you assigned at an earlier stage. This does not clear your selection, which makes it easier to make the service available again to these people at a later stage.
-
If you assign people attributes, you can include all people attributes of type Text that are defined under Data Model. This helps to add to the qualification context people using their attributes, like their role. To fully cover this use case, a single attribute can be added multiple times.
An attribute is added simply by using the attribute selector and then the desired value is inserted. If this value matches any people, then those people will become qualified for the respective entitlement, if no other restrictions or dependencies apply.The value of the attributes also allows the use of wildcards in case similar values need to be added to the qualification criteria.
Wildcards can be added at the beginning of the phrase, at the end or in the middle.Qualifications based on people attribute values are not case-sensitive.
Disabling the use of people attributes for qualification
In order to disable the use of people attributes for qualifications, you need to modify the following files.
Note that both changes are required to maintain consistency in transaction logging between components.The resote.exe.config file of the Transaction Engine-
Go to C: > Program Files > RES Software > IT Store > Transaction Engine > resote.exe.config.
-
In the resote.exe.config file, locate the <appSettings> node and add:
<appSettings>
<add key="UseQualificationAttributeValue" value="False" />
</appSettings> -
Restart the RESOTE service to apply the changes.
The Web.config file of the Management Portal-
Go to C: > Program Files (x86) > RES Software > IT Store > Web Console > Web.config.
-
In the Web.config file, locate the <appSettings> node and add:
<appSettings>
<add key="UseQualificationAttributeValue" value="False" />
</appSettings>
-
Perform an IIS restart to apply the changes.
Currently, turning this feature off is not reflected in the UI.
It was introduced in order to allow more control over the qualification engine and will be improved in future releases to also include the UI changes. -
- If you change the qualification criteria of the service, subscribers may no longer be qualified. This may lead to an automatic return of the service, provided you selected the Start Return trigger option When subscribers no longer qualify (auto deprovisioning). If you did not select this option, the service is not returned automatically, even if the subscriber no longer qualifies.
Restrictions
Optionally, restrict the qualification to another service: People only qualify if they do not subscribe to the other service. For example, you can specify that a person does not qualify to the service Microsoft Visio if he already subscribes to the service SmartDraw.
Dependencies
Optionally, let the qualification depend on another service: people only qualify if they subscribe to the other service. For example, you can specify that a person only qualifies to the service E-mail account, if he subscribes to the service Windows User Account.
- You can optionally add a Cancel Another Service action to the return workflow of this service. This ensures that when the service Windows User Account is returned, the service whose qualification depends on it, E-mail account, is also returned.
- You can only add Cancel Another Service actions if you have Modify permission on the service.
- Cancel Another Service actions are added as first action in the return workflow. This means that if the return workflow of the service contains a pre-Provide Information action, it no longer functions as a pre-provide.
- If you remove the dependency, Cancel Another Service actions are not removed from the return workflow of other services.
Changing existing qualifications
When you make changes to the qualification settings of a service, and save the service, the Qualification results page opens. This page shows how many people qualify for the service with the new settings, and how they impact the number of subscribers to the service. This helps you decide whether to actually implement the changes.
If the changes impact a large number of users or in environments with many organizations, the calculation of the qualification results may take some time.
You can therefore also choose to skip the visualization of the end results, by clicking Next during the calculation. This event will be logged in the Audit section of the Diagnostics tab.
The Qualification results page is not shown when you update a service by importing a Building Block, or when you disabled Enable transactions on the Properties tab of the Service page.
Qualification example 1
Suppose someone has the following classifications:
- Locations\Boston
- Locations\London
This means this person qualifies for all services with the qualification criteria:
- Locations\Boston
- Locations\London
This person does NOT qualify for services with the qualification criteria:
- Locations\Boston
- Roles\Managers
- or -
- Locations\London
- Roles\Managers
Qualification example 2
Suppose someone has the following classifications:
- Locations\Boston
- Roles\Managers
OR
- Locations\London
- Departments\HR department
This means this person qualifies for all services with the qualification criteria:
- Locations\Boston
- Roles\Managers
This person ALSO qualifies for services with the qualification criteria:
- Locations\London
- Departments\HR department
Qualification example 3
Suppose a service has the qualification criteria:
- Locations\Boston
- Roles\Managers
OR
- Locations\London
- Departments\HR department
This means that people with the following classifications qualify for this service:
- Locations\Boston
- Roles\Managers
In addition, people with the following classifications ALSO qualify for this service:
- Locations\London
- Departments\HR department
Qualification example 4
Suppose a service has the qualification criteria:
- Locations\Boston
- Roles\Managers
OR
- Attribute Job Profile = "Channel Sales Manager"
OR
- Attribute Job Profile = "Account Manager"
OR
- Attribute Job Profile = "Director, Inside Sales"
This means that people with the following classifications qualify for this service:
- Locations\Boston
- Roles\Managers
In addition, people with one or more of the following attributes ALSO qualify for this service:
- Attribute Job Profile = "Channel Sales Manager"
- Attribute Job Profile = "Account Manager"
- Attribute Job Profile = "Director, Inside Sales"
Qualification example 5
Suppose a service has the qualification criteria:
- Attribute Job Profile = "*Sales Manager"
OR
- Attribute Job Profile = "Key*"
OR
- Attribute Job Profile = "Director*Sales"
This means that people with the following classifications qualify for this service:
- Attribute Job Profile = "Channel Sales Manager"
- Attribute Job Profile = "Internal Sales Manager"
- Attribute Job Profile = "Key Account Manager"
- Attribute Job Profile = "Key Account Representative"
- Attribute Job Profile = "Director, Inside Sales"
Logic examples:
If available values for Job Profile are:
- Inner Sales
- Sales Expert
- Expert Sales Engineer
then:
- *Sales* will qualify Inner Sales AND Sales Expert AND Expert Sales Engineer (all of them):
all values contain 'Sales' - * Sales * will qualify ONLY Expert Sales Engineer:
it is the only value with a [space] before and after Sales - Sales* will qualify ONLY Sales Engineer:
it is the only value that starts with 'Sales' - *Sales will qualify ONLY Inner Sales:
it is the only value that ends with 'Sales'