Implementation Guide › Optimizing Identity Manager › Role Optimizations › Guidelines for Policy Rule Creation

Guidelines for Policy Rule Creation

One of the key factors in determining the overall performance of role policy evaluations is the amount of time it takes to evaluate any single policy rule. To improve policy rule evaluation time, note the following when you create a policy:

• When possible, limit the number of policy objects that Identity Manager creates and the number of user store searches that it performs by creating policy rules with complex expressions.

  A single rule with a complex expression is more efficient than multiple rules with simple expressions.

• When possible, select the most efficient and scalable type of policy rule.
• Enable the in-memory evaluation option for policy rules.

  The in-memory evaluation option significantly reduces policy evaluation time by retrieving information about a user to be evaluated from the user store and storing a representation of that user in memory. Identity Manager uses the in-memory representation to compare attribute values against policy rules.

  Note: For more information about the in-memory evaluation option, see the Configuration Guide.

• Tune the user store.
• Tune the policy store, if your Identity Manager implementation includes SiteMinder.

More information:

Limit Policy Objects and User Store Searches

Select Scalable Policy Rule Types

User Store Tuning