Administration Guide › Role Planning › Role Characteristics › Add and Remove Actions

Add and Remove Actions

You must specify an Add and Remove Action for CA IdentityMinder to correctly manage a role’s membership when an administrator grants or revokes the role.

• The Add Action must make the user meet the criteria in one of the role’s member rules. For example, if the member rule for the User Manager role states that role members have "User Manager" as a value of their Admin Roles attribute, the Add Action must add "User Manager" to the Admin Roles attribute.
• The Remove Action should alter the profile of a user so that the user no longer matches the member rule when the rule is revoked.

Each role can have two add actions and two remove actions.

If administrators can add and remove members of the role, you define add and remove actions. Otherwise, the user has the role by meeting the member rule, such as by belonging to the RoleAdmins group. For example:

• Role A can be assigned by an administrator, so add or remove actions will be defined.
• Role B has a rule that all members of Group "finance" have the role. This role cannot be assigned, so it has no add or remove action.

When you define add and remove actions, consider using the Admin Role attribute, which CA IdentityMinder can use to store a list of user's roles. For example, you can configure an add action that adds Employee to a user's Admin Role attribute when that user is added as a member of the Employee role. When an administrator assigns the Employee role to a manager who already has the Self Administrator and User Manager roles, the manager's Admin Role attribute would contain the following values: Self Administrator, User Manager, Employee.

To use the Admin Role attribute, the %ADMIN_ROLE_CONSTRAINT% well-known attribute must be mapped to a multi-valued attribute in user profiles. For more information, see the CA IdentityMinder Configuration Guide.

Important! When defining an add action, avoid setting up a rule that refers to the role you are defining. For example, do not define the add action that makes a member of Role A by being a member of Role A. This will create a recursive error that will cause the policy server to restart.