PolicyConstraintsType (Complex Type)

Items

• $itemDefinition.Name.LocalPart

  Flags: RAM,runtime

  Multiplicity: [0,1]

  Identifier of the constraint. It is used when midPoint needs to refer to a specific constraint, e.g. in order to record exception. This element is formally specified as optional, mostly due to the compatibility reasons. But it has to be provided in order for some functionality to work correctly.

• $itemDefinition.Name.LocalPart

  Flags: RAM,runtime

  Multiplicity: [0,1]

• $itemDefinition.Name.LocalPart

  Flags: RAM,runtime

  Multiplicity: [0,1]

  How should be triggering of this constraint presented, e.g. in enforcement messages, in approvals, in certification, in notifications, etc.

• $itemDefinition.Name.LocalPart

  Flags: RAM,runtime

  Multiplicity: [0,-1]

  Particular state of the object, described by a filter or an expression.

• $itemDefinition.Name.LocalPart

  Flags: RAM,runtime

  Multiplicity: [0,-1]

  Particular state of an assignment, described by a filter or an expression.

• $itemDefinition.Name.LocalPart

  Flags: RAM,runtime

  Multiplicity: [0,-1]

  The focus has assignment(s) of given object(s).

• $itemDefinition.Name.LocalPart

  Flags: RAM,runtime

  Multiplicity: [0,-1]

  The focus has no assignment(s) of given object(s).

• $itemDefinition.Name.LocalPart

  Flags: RAM,runtime

  Multiplicity: [0,-1]

  Exclusion constraint. Constraint that forbids this object to be assigned together with other object.

• $itemDefinition.Name.LocalPart

  Flags: RAM,runtime

  Multiplicity: [0,-1]

  Actual number of objects that have this role assigned is lower than prescribed value. (The constraint should be perhaps named minAssigneesViolation.)

• $itemDefinition.Name.LocalPart

  Flags: RAM,runtime

  Multiplicity: [0,-1]

  Actual number of objects that have this role assigned is higher than prescribed value. (The constraint should be perhaps named maxAssigneesViolation.)

• $itemDefinition.Name.LocalPart

  Flags: RAM,runtime

  Multiplicity: [0,-1]

  Actual number of objects that have this object (e.g. role) assigned is lower than prescribed value. This is the same as minAssignees, but indicates that the constraint should be evaluated against an object when evaluating object constraints. HIGHLY EXPERIMENTAL

• $itemDefinition.Name.LocalPart

  Flags: RAM,runtime

  Multiplicity: [0,-1]

  Actual number of objects that have this object (e.g. role) assigned is higher than prescribed value. This is the same as minAssignees, but indicates that the constraint should be evaluated against an object when evaluating object constraints. HIGHLY EXPERIMENTAL

• $itemDefinition.Name.LocalPart

  Flags: RAM,runtime

  Multiplicity: [0,-1]

  Constraint that triggers when the object is modified. Modification of the object (add, modify, delete). (This constraint should be perhaps named objectModification.)

• $itemDefinition.Name.LocalPart

  Flags: RAM,runtime

  Multiplicity: [0,-1]

  Constraint that triggers when the object is assigned, unassigned or the assignment is modified. Modification of an assignment, i.e. where this object is a target of assignment that is being modified. (This constraint should be perhaps named assignmentModification.)

• $itemDefinition.Name.LocalPart

  Flags: RAM,runtime

  Multiplicity: [0,-1]

  A constraint that triggers when validity of an object or any of its time-sensitive items (e.g. password) is about to end.

• $itemDefinition.Name.LocalPart

  Flags: RAM,runtime

  Multiplicity: [0,-1]

  A constraint that triggers when validity of an assignment or any of its time-sensitive items (e.g. password) is about to end.

• $itemDefinition.Name.LocalPart

  Flags: RAM,runtime

  Multiplicity: [0,-1]

  Occurrence of the policy situation within an object or an assignment.

• $itemDefinition.Name.LocalPart

  Flags: RAM,runtime

  Multiplicity: [0,-1]

  Constraints for collection stats (statistics). Can be used to trigger policy rules on the number of objects in collection, percentage and so on.

  Policy rules with this constraint are ignored during normal processing. Evaluation of such policy rules require special handling (e.g. scanner task).

• $itemDefinition.Name.LocalPart

  Flags: elaborate,RAM,runtime

  Multiplicity: [0,-1]

  Constraints that must all apply. (But note that if there are more values of this item, they are interpreted according to the enclosing operator.)

• $itemDefinition.Name.LocalPart

  Flags: elaborate,RAM,runtime

  Multiplicity: [0,-1]

  Constraints from which at least one must apply. (But note that if there are more values of this item, they are interpreted according to the enclosing operator.)

• $itemDefinition.Name.LocalPart

  Flags: elaborate,RAM,runtime

  Multiplicity: [0,-1]

  The inner constraint must not apply.

• $itemDefinition.Name.LocalPart

  Flags: elaborate,RAM,runtime

  Multiplicity: [0,-1]

  Specifies how the inner constraints are to be evaluated with regards to operation start and end state. May not include any transitional constraints itself!

• $itemDefinition.Name.LocalPart

  Flags: RAM,runtime

  Multiplicity: [0,-1]

  References another policy constraint e.g. by its name. The referenced constraint must be present as part of policy rules gathered for a given assignment or object. Also, all declared global constraints are available for referencing, regardless of which objects they are attached to or whether they are active or not.