Object Lifecycle Policies | Memority Documentation

Definition

An Object Lifecycle Policy allows to configure rules, on all Object Types, that will alter an Object attribute directly when certain lifecycle events occur.
This can be:

when creating an Object
when assigning Roles or Rights on Identities
when deactivating an Object
when updating the status of Object
when freezing a Role Assignment (it cannot be changed by automatic processes, the Role Assignment end date is ignored, as well as Role Assignment Policies that might remove it).

Those changes must be performed in the same operation as the one that triggered the lifecycle event.

There is a Lifecycle control that is split into stages. The Object Lifecycle Policies can introduce behavior between those stages.

Those Lifecycle Policies are similar to Object Policies, however the Groovy script allows to directly manipulate the Attributes of the Object.

Usage

We want to configure an Object Lifecycle Policy that will freeze Role Assignment by setting a freeze ending date on it.
In this case, the Role Assignment is frozen when the security organization of the Identity is updating.
When the Role Assignment is frozen, it is not possible to perform modification or to delete it.
To unfreeze the Role Assignment, you must update the date of the frozen until Attribute (by API or by configuring in the Groovy script).

	Steps	Preview
1	Configure an Object Lifecycle Policy that will freeze a Role Assignment.	ObjectLifecyclePolicy.xml
2	Assign a Role to an Identity.
3	Update the security organization of the Identity. Wait until the configured delay in the Object Lifecycle Policy has passed. Access the Role dashboard of the Identity. A snowflake is displayed on the line of the assigned Role and the date of frozen until is displayed when clicking on the "Action" button.

Steps

Preview

Configure an Object Lifecycle Policy that will freeze a Role Assignment.

ObjectLifecyclePolicy.xml

Assign a Role to an Identity.

Update the security organization of the Identity.
Wait until the configured delay in the Object Lifecycle Policy has passed.
Access the Role dashboard of the Identity.
A snowflake is displayed on the line of the assigned Role and the date of frozen until is displayed when clicking on the "Action" button.

Configuration

🎯

You can access the Object Lifecycle Policy configuration :

by clicking on "Policies" → “Object Lifecycle Policy”
by clicking on "System" → "Configurations" → "Data Model" and perform an import/export.

Properties

Object Lifecycle Policy

Properties name	Type	Mandatory	Description	Values (default value in bold)
id	`String`	YES	The identifier is the unique identifier of the Object Lifecycle Policy. It is case sensitive and no special characters (except - or _) are allowed.	-
name	`String`	YES	The Object Lifecycle Policy name. The name may be different from the identifier.Specifying the name first allows to define automatically the identifier. Must be at least 4 characters long.	-
active	`Boolean`	NO	Allows to define if the Object Lifecycle Policy is activated or not.	ON, OFF
description	`String`	NO	Allows to describe the purpose of the Object Lifecycle Policy.	-
objectKind	`Enum`	YES	Allows to link the Object Lifecycle Policy to an Object kind. The Policy will apply to this Object kind.	Identity, Organization, Resource, Role, Role Publication
objectTypes	`Enum`	NO	Allows to choose on which Objects the Object Lifecycle Policy will be applied.	List of created Object Types
stage	`Enum`	YES	Allows to choose stage according to the configured Object kind.	Before common stage, After common stage, Before assignments stage, After assignments stage, Before authentication methods stage, After authentication methods stage, Before inheritance stage, After inheritance stage, Before finalize stage, After finalize stage
rules	`Groovy script`	YES	Allows to configure Transform rules by Groovy script.	-

Stage

Stage	Object kind	Technical values (before/after)	Description
Before common stage After common stage	`All`	COMMON_PRE COMMON_POST	Allows to manage the Object Lifecycle: handling "enable" attribute: changes authorization, activation modes, enable from/until) creation, update, deletion dates in metadata sanity checks on current operation
Before assignments stage After assignments stage	`Identity`	ASSIGNMENTS_PRE ASSIGNMENTS_POST	Allows to manage the Roles and Rights hierarchy update: computing the dimensions in Role and Rights applying Role Assignment Policies updating Role status
Before refresh orders stage After refresh orders stage	`Role`	REFRESH_ORDERS_PRE REFRESH_ORDERS_POST	Allows to manage the generation of refresh orders for Roles and Role Assignment Policy changes, when necessary.
Before inheritance stage After inheritance stage	`Organization`	INHERITANCE_PRE INHERITANCE_POST	Allows to manage the mechanisms related to inheritance in Objects that are organized as a hierarchy: inheritance of Attirbutes setting or hierarchy path
Before authentication methods stage After authentication methods stage	`Identity`	AUTH_PRE AUTH_POST	Allows to manage the mechanisms related to Authentication Methods: activation and deactivation of methods triggering of automated actions if necessary
Before finalize stage After finalize stage	`All`	FINALIZE_PRE FINALIZE_POST	Allows to manage the last minute operations. Can be used by Object Lifecycle Policies to appli behavior a the very last moment.