Application Dimensions

Application Dimensions let you manage application entitlements (profiles, groups or licenses) as entries maintained by administrators in Memority, and reuse them consistently in provisioning rights and applicative roles. Some prerequisites must be met before you can use them in a tenant.

This page explains what Application Dimensions are, how they support provisioning and how to use them.

Definitions

What is provisioning ?

See the definition of provisioning on the REST provisioning page.

What are Application Dimensions ?

Application Dimensions are entries that you create and maintain in Memority to represent the entitlements of a target application, such as:

• profiles;

• groups;

• licenses.

Once created, they can be selected as dimension values when you configure provisioning rights and applicative roles.

What is a dimension in Memority ?

In Memority, a dimension is a parameter of a right that specifies what the right applies to (for example which application, license or group). Dimensions are usually valued when you build an applicative role or when you assign a role.

More information: Rights - Dimensions

What is the Technical ID used for ?

Each dimension item has a Technical ID (rsrcTechnicalId). This value must match the identifier expected by the target system (SKU ID, group ID, role code, and so on). Provisioning connectors send this value when they call the target application.

Application Dimensions in Memority

Application Dimensions are available in the user portal. They are designed for provisioning use cases where entitlements must be selected from a controlled catalog that you build for each application.

What can be managed ?

Memority manages three categories of dimension items:

• Profiles: application profiles or functional profiles;

• Groups: application groups or teams;

• Licenses: application licenses or SKUs.

Typical process flow

A typical use follows the steps below:

1. Create the entitlement catalog of the application in Memority (profiles, groups, licenses).

2. Create application-specific provisioning rights based on the preset templates.

3. Build applicative roles with these rights, and select the dimension values.

4. When the role is assigned, provisioning uses the selected dimension items and their Technical ID.

Prerequisites

Tenant prerequisites

Functional prerequisites

Configuration

Where to manage Application Dimensions

In the user portal:

1. Go to Applications.

2. Open the target application.

3. Open the Applicative roles tab.

4. Open the Dimensions sub-tab.

The Dimensions sub-tab contains three sections: Profiles, Groups and Licenses.

Create dimension items (profiles, groups, licenses)

1. In the relevant section (Profiles, Groups or Licenses), click Create.

2. Fill in the dimension item form.

3. Submit.

The most important fields are:

• Name: it must be easy to understand for administrators.

• Technical ID: it must match the identifier used by the target system.

Create application-specific provisioning rights

To use dimension items in provisioning, create application-specific rights based on the templates delivered with the presets.

Depending on the needs of the target application, use either:

• a single-value right (exactly one profile, group or license);

• a multi-value right (several profiles, groups or licenses).

Use dimensions in an applicative role

1. Create or edit an applicative role for the application.

2. Add the relevant right (profile, group or license).

3. Select the dimension values from the catalog that you created.

When a role is assigned to an identity, the provisioning connector uses the selected dimension items and their Technical ID to provision the target application.

Troubleshooting

I cannot find the Dimensions screen

• Check that the tenant uses presets 3.3.0 or later. If it does not, install the Application Dimensions Manager plugin to add this configuration.

• Check your permissions.

Provisioning assigns the wrong entitlement

• Double-check the Technical ID of the selected dimension item.

• Check that the connector expects this exact identifier format.

A role assignment references an expired or disabled dimension

By default, a role assignment is not updated automatically when a dimension expires (for example, when its end date is reached).
This has no visible impact on provisioning as long as the dimension remains on the role assignment.
If you remove the dimension value from the role assignment, you cannot select the same value again later if the dimension item is expired or disabled. This is expected: expired dimensions are not meant to be selected again, unless they are enabled again or extended.

INTERNAL_SERVER_ERROR after a dimension is permanently deleted

When a dimension reaches its end date, it expires and is disabled. Then, according to the lifecycle policy of the tenant, it is later marked as deleted and finally permanently removed from the tenant.
If the dimension is permanently removed while one or more role assignments still reference it, the role assignment screens of the impacted identities return an INTERNAL_SERVER_ERROR.
In this situation, provisioning can remain in place as long as the assignment is not modified, because the role assignment still contains the dimension reference.

Workaround:

• Update or remove the deleted dimension on all impacted role assignments.

• Agree with the client on the expected action when a dimension expires, so that the update can be automated.

Application Dimensions Manager plugin

The Application Dimensions Manager plugin adds to an existing tenant the configuration required to manage Application Dimensions as native resources in Memority, and makes all the features described on this page available.

When to use the plugin

Use the plugin if your tenant was not initialized with presets 3.3.0 or later and you want to use Application Dimensions.

Installation

The plugin is installed with the standard procedure described on the Memority Plugins page. This section only gives the information that is specific to the Application Dimensions Manager plugin.

Installation mode: single installation. The plugin can be installed only once per project.

• Plugin form parameters: none. The plugin requires no parameter.

• Secrets: none.

• Data import: none. The plugin generates no data files. Only the configuration (step 8) and the translations (step 9) must be imported.

What does it do ?

The plugin generates, in just a few steps, the configuration required to make Application Dimensions available on an existing tenant.

It creates the resource types, screens, deduplication policies and right templates needed to manage profiles, groups and licenses in Memority, and to reuse them consistently in provisioning rights and applicative roles.

In addition to this resource model, the plugin updates the existing configuration required to use these new features.

Technical details

Generated files

Updated files

Related documentation

• https://doc.memority.eu/configuration-guide/latest/rights

• https://doc.memority.eu/setup-guide/latest/memority-plugins