Implementation Guide › Optimizing CA IdentityMinder › Identity Policy Optimizations › Design Efficient Identity Policies

Design Efficient Identity Policies

Use the following guidelines when you create identity policies:

• Limit the number of policy objects

  CA IdentityMinder creates objects in the object store that support identity policies. To reduce the number of objects in the object store, create identity policies with complex expressions.
  A similar approach is recommended for role policies.

• Limit identity policy set iterations

  You can configure the recursion level for an identity policy, which determines the number of times that CA IdentityMinder evaluates and applies identity policies when a user is synchronized. For example, an identity policy may change a user's department when the user is assigned a role. The new department triggers another identity policy. However, if the recursion level is set to 1, the subsequent change is not made until the user is synchronized again.

  Setting the recursion level limits the number of times that CA IdentityMinder must evaluate identity policies.

• Limit dependencies between identity policy rules

  You can create an identity policy where the change action (Action on Apply Policy or Action on Remove Policy) of one policy is used in the identity policy condition of another policy as shown in the following table.

When CA IdentityMinder evaluates this type of policy, it must evaluate and apply changes at least twice to ensure that both conditions are met. The recursion level, which is set for an entire CA IdentityMinder environment, must be greater than 1, which then causes additional evaluations for each identity policy set.