Using Policies to Manage Requests › How to Create a Condition › Conditions Based on the Attributes of Users

Conditions Based on the Attributes of Users

You can specify conditions based on the attributes of users, as follows:

• Conditions based on the attributes of the Requested For user

  The Requested For user is the user who receives the requested services.

• Conditions based on the attributes of the Requested By user

  The Requested By user is the user who created and submitted the request.

  The Requested For user and Requested By user can be the same user or different users. If you submit a request for yourself, you are both the Requested For user and the Requested By user. If you submit a request for another user, you are the Requested By user, and the other user is the Requested For user.

• Conditions based on the attributes of the assigner

  Typically, the assigner is a workflow process utilizing an automated user like CERT-Service Delivery. Relatively few conditions are likely to use these attributes.

You can use the following attributes in conditions based on the attributes of users:

The following attributes may require explanation:

defaultDomain

Each user has a default domain (business unit) in the user profile. Administrators set this default business unit when they add or edit the user.

Specifies different values for different parameters, as follows:

• For the Requested For user parameter, specifies the default business unit of the Requested For user
• For the Requested By user parameter, specifies the business unit of the request

Enter the ID of the business unit you want from the usm_tenant_ext table.

For example, to list the values of all business unit IDs in that table, run the following query on the MDB from your database client:

select tenant_id from usm_tenant_ext

To list the default business unit of a user, run the following query on the MDB from your database client:

select domain from usm_contact_domain_role where user_id=userid and default_domain=1

userid

Specifies the user ID whose default business unit you want to find.

default_domain=1

Specifies the default business unit of the user.

defaultRole

Specifies the default role of a user in a domain.

Enter the ID of the role ID you want from the usm_role table.

For example, to list the IDs of all roles in that table, run the following query on the MDB from your database client:

select role_id from usm_role

To list the default role of a user in a domain, run the following query on the MDB from your database client:

select role_id from usm_contact_domain_role where user_id=userid and default_domain=1

userid

Specifies the user ID whose default domain you want to find, for example:

select role...where user_id='john smith'...

If the user ID includes one or more spaces, enclose it with single quotation marks, as shown in the example on the previous line.

default_domain=1

Specifies that the role is for the default domain of the user.

delegate

Specifies the user ID of a delegate for auto-delegation of the requests pending action of the user. Such delegates appear in the user profile in the Request Auto Delegation section. Users and their administrators can specify such delegates in the profile.

If any delegate specified in the condition matches any delegate of the Requested For user, the Catalog system assigns the pending action.

Enter the user ID of the delegate you want from the MDB.

For example, to list the delegates for a user ID, run the following query on the MDB from your database client:

select delegate_id from usm_request_Auto_delegation where delegator_id=userid and delegation_type=0

userid

Specifies the user ID of the delegator.

delegation_type=0

Specifies that the type of delegation is auto-delegation.

Contains all the CA EEM groups to which the user belongs. You can, for example, create a policy condition to assign a request pending action based on whether a user belongs to a specific CA EEM user group.

To find the names of CA EEM user groups, query CA EEM. Log in to CA EEM and review the group names.

You can use the groups property to check if the requested by user is a member of a CA EEM group. For example, you can create a policy that requires all requests created by developers to be assigned to architects. To do so, use the following permission to check the requested by user group membership in the developers group:

_.request.requestedByUser.groups.indexOf(‘developers’) >= 0

In contrast, you can also create a policy for users who are not members of a CA EEM group. To do so, specify the following expression:

_.request.requestedForUser.groups.indexOf(‘developers’) < 0

localeCountry

Specifies the ISO 3166 two-letter country code of the logged in user.

For a complete list of these codes, see the website of the University of Berlin. (http://userpage.chemie.fu-berlin.de/).

At publication time, the direct link to the web page containing this list is http://userpage.chemie.fu-berlin.de/diverse/doc/ISO_3166.html.

Commonly used ISO 3166 two-letter country codes include the following:

Brazil – BR

China – CN

France – FR

Germany – DE

Italy – IT

Japan – JP

Spain – ES

United Kingdom – GB

United States – US

Note: The localeCountry attribute uses different values than the country attribute (from the ca_country table) used in several other conditions. Be careful to specify the correct attribute with the correct values in each condition you create.

manager

Enter the value of the manager user ID you want from the ca_contact table.

For example, to list the values of all manager user IDs in that table, run the following query on the MDB from your database client:

select supervisor_contact_uuid from ca_contact

status

Specifies the status of the Requested For user, as follows:

0 - Active

1 - inactive (deleted)

timezone

Specifies the code for the time zone (such as Eastern USA, Greenwich Mean Time, Amazon Time, and so forth) for the business unit.

Enter the time_zone_code from the ca_time_zone table.

For example, run the following query on the MDB from your database client:

select time_zone_code from ca_time_zone

uuid

Enter the value of the contact_uuid you want from the ca_contact table.

For example, run the following query on the MDB from your database client:

select contact_uuid from ca_contact

Title

Enter the value of the job title for the user. The ca_contact table stores the job title of each user.

For example, list the job title of a specific user (here, Omar PE Patel) in that table. To do so, run the following query on the MDB from your database client:

Select job_title from ca_contact where userid='Omar PE Patel'

To list the values of all job titles available in CA Service Catalog, run the following query:

select id from ca_job_title