Request strategies | Memority Documentation

Organizational

The Organizational strategy is based on the principle that the requester has an administration right on an organization allowing him to grant a certain role to identities in this organization.

In our example, Andrea who is an HR for the London office should be able to request role A, B, C for Users, like John, that is under management in the London area.

To support this use case, we will have:

Publications that allow role request of the role A, B and C for the organization(s) where they can be granted.
- Like described in Figure 12, we have one publication for each role to:
  - allow the request of role A in UK Branch organization and below
  - allow the request of role B in UK Branch organization and below
  - allow the request of role C in London organization and below
- An organizational role request policy based on the HR right
  - This right is carried by the attribute requester on the role

Object

The Object strategy is based on the principle that the requester has a certain right on the requested role or an Object described by the requested Role (an application for example) allowing him to grant the role to all identities (in the Publication organization or below).

In our example, Bob who is the application manager of the Application E should be able to request the role associated to the application E for Users.

To support this use case, we will have:

A publication that allows role request off the role E for the organization(s) where it can be granted.
- Like described in Figure 13, we have two publications for the Role E to:
  - allow the request of role in UK Branch organization and below
  - deny the request of role in Marketing unit
- An object role request policy based on the application manager right
  - This right is carried by the attribute requester on the role
  - And the attribute application to indicated on which object the requester is expected to have the right on.

For organizational and object strategies, right(s) identifier(s) can be carried by an attribute on the role, the publication or directly by the policy itself.

Self

The self strategy is based on the principle that the requester has an administration right on an organization allowing him to grant a certain role to identities in this organization.

In our example, Bob who is the application manager of the Application E should be able to request the role associated to the application E for Users.

To support this use case, we will have:

A publication that allows role request off the role E for the organization(s) where it can be granted.
- Like described in Figure 13, we have several publications for the Role E to:
  - allow the request in Liverpool organization and below
  - allow the request in London organization and below
  - deny the request in Marketing unit
An object role request policy based on the application manager right
- This right is carried by the attribute requester on the role
- And the attribute application to indicated on which object the requester is expected to have the right on.