PolicyConstraintsType (Complex Type)

Items

• name

  Flags: RAM,runtime

  Multiplicity: [0,1]

  Identifier of the constraint. It is used when midPoint needs to refer to a specific constraint, e.g. in order to record exception. This element is formally specified as optional, mostly due to the compatibility reasons. But it has to be provided in order for some functionality to work correctly.

• description

  Flags: RAM,runtime

  Multiplicity: [0,1]

• documentation

  Flags: RAM,runtime

  Multiplicity: [0,1]

  Technical documentation for a particular object or construct.

  The purpose of this element is to document system configuration and behavior. The documentation will not be presented to end users. In fact, it will probably not be presented at all in midPoint user interface. This documentation element is supposed to be a part of the technical documentation of midPoint deployment. The tools than generate deployment configuration will look for these elements and combine them to compiled documentation document.

  AsciiDoc formatting is assumed for this element. Any leading or trailing whitespace is skipped. Indentation equivalent to he indentation of the first non-blank line of text is also skipped.

• presentation

  Flags: RAM,runtime

  Multiplicity: [0,1]

  How should be triggering of this constraint presented, e.g. in enforcement messages, in approvals, in certification, in notifications, etc.

• objectState

  Flags: RAM,runtime

  Multiplicity: [0,-1]

  Particular state of the object, described by a filter or an expression.

• assignmentState

  Flags: RAM,runtime

  Multiplicity: [0,-1]

  Particular state of an assignment, described by a filter or an expression.

• hasAssignment

  Flags: RAM,runtime

  Multiplicity: [0,-1]

  The focus has assignment(s) of given object(s).

• hasNoAssignment

  Flags: RAM,runtime

  Multiplicity: [0,-1]

  The focus has no assignment(s) of given object(s).

• requirement

  Flags: RAM,runtime

  Multiplicity: [0,-1]

  Requirement constraint. Constraint that mandates that this object to be assigned together with other object. It can be used to require presence of clearances, job roles, require assignment is specific organization units, etc.

• exclusion

  Flags: RAM,runtime

  Multiplicity: [0,-1]

  Exclusion constraint. Constraint that forbids this object to be assigned together with other object. It is usually used to enforce segregation of duty (SoD) policies.

• minAssignees

  Flags: RAM,runtime

  Multiplicity: [0,-1]

  Actual number of objects that have this role assigned is lower than prescribed value. (The constraint should be perhaps named minAssigneesViolation.)

• maxAssignees

  Flags: RAM,runtime

  Multiplicity: [0,-1]

  Actual number of objects that have this role assigned is higher than prescribed value. (The constraint should be perhaps named maxAssigneesViolation.)

• objectMinAssigneesViolation

  Flags: RAM,runtime

  Multiplicity: [0,-1]

  Actual number of objects that have this object (e.g. role) assigned is lower than prescribed value. This is the same as minAssignees, but indicates that the constraint should be evaluated against an object when evaluating object constraints. HIGHLY EXPERIMENTAL

• objectMaxAssigneesViolation

  Flags: RAM,runtime

  Multiplicity: [0,-1]

  Actual number of objects that have this object (e.g. role) assigned is higher than prescribed value. This is the same as minAssignees, but indicates that the constraint should be evaluated against an object when evaluating object constraints. HIGHLY EXPERIMENTAL

• modification

  Flags: RAM,runtime

  Multiplicity: [0,-1]

  Constraint that triggers when the object is modified. Modification of the object (add, modify, delete). (This constraint should be perhaps named objectModification.)

• assignment

  Flags: RAM,runtime

  Multiplicity: [0,-1]

  Constraint that triggers when the object is assigned, unassigned or the assignment is modified. Modification of an assignment, i.e. where this object is a target of assignment that is being modified. (This constraint should be perhaps named assignmentModification.)

• objectTimeValidity

  Flags: RAM,runtime

  Multiplicity: [0,-1]

  A constraint that triggers when validity of an object or any of its time-sensitive items (e.g. password) is about to end.

• assignmentTimeValidity

  Flags: RAM,runtime

  Multiplicity: [0,-1]

  A constraint that triggers when validity of an assignment or any of its time-sensitive items (e.g. password) is about to end.

• situation

  Flags: RAM,runtime

  Multiplicity: [0,-1]

  Occurrence of the policy situation within an object or an assignment.

• custom

  Flags: RAM,runtime

  Multiplicity: [0,-1]

  Custom ways of evaluating a policy constraint. Used typically for transitional constraints. (State-based custom ones can always be evaluated using `objectState` constraint.) TODO reconsider the name

• collectionStats

  Flags: RAM,runtime

  Multiplicity: [0,-1]

  Constraints for collection stats (statistics). Can be used to trigger policy rules on the number of objects in collection, percentage and so on.

  Policy rules with this constraint are ignored during normal processing. Evaluation of such policy rules require special handling (e.g. scanner task).

• alwaysTrue

  Flags: elaborate,RAM,runtime

  Multiplicity: [0,-1]

  This constraint always applies.

• orphaned

  Flags: RAM,runtime

  Multiplicity: [0,-1]

  The object (currently supported are tasks) is orphaned i.e. has declared a parent but the parent does not exist.

• and

  Flags: elaborate,RAM,runtime

  Multiplicity: [0,-1]

  Constraints that must all apply. (But note that if there are more values of this item, they are interpreted according to the enclosing operator.)

• or

  Flags: elaborate,RAM,runtime

  Multiplicity: [0,-1]

  Constraints from which at least one must apply. (But note that if there are more values of this item, they are interpreted according to the enclosing operator.)

• not

  Flags: elaborate,RAM,runtime

  Multiplicity: [0,-1]

  The inner constraint must not apply.

• transition

  Flags: elaborate,RAM,runtime

  Multiplicity: [0,-1]

  Specifies how the inner constraints are to be evaluated with regard to operation start and end state. May not include any transitional constraints itself!

• ref

  Flags: RAM,runtime

  Multiplicity: [0,-1]

  References another policy constraint e.g. by its name. The referenced constraint must be present as part of policy rules gathered for a given assignment or object. Also, all declared global constraints are available for referencing, regardless of which objects they are attached to or whether they are active or not.