CA Identity Manager Implementation Guide - CA Technologies

Role Optimizations3. Identity Manager evaluates every member policy for every admin role in theenvironment to determine which admin roles apply to the user.Note: This evaluation occurs only once for a given user. After the initialevaluation, Identity Manager caches the results. Identity Manager uses thecached information until a change occurs to the user or to the set of memberpolicies, which causes Identity Manager to refresh the information in thecache.4. The Identity Manager User Console displays the categories that the user canview based on his roles.This process occurs for every user that logs into the User Console. If an IdentityManager environment contains a large number of roles, or inefficient memberpolicies, role membership evaluation can significantly impact performance. Inthis case, the initial screen that users see when they log into the User Consolemay display slowly.Note: Identity Manager does not need to evaluate member policies when a useraccesses a public task to self-register or to request a forgotten password. Inthese cases, Identity Manager does not need a list of the user's roles because itdoes not display the complete User Console.Role Objects and PerformanceTo support each role, Identity Manager creates a number of objects in theIdentity Manager object store (see page 34), depending on the roleconfiguration.Identity Manager creates one base object for each role. In addition to the baseobject, Identity Manager creates two objects for each member, admin, andowner policy rule (see page 73), and two objects for each scope rule. The ruleobjects include:■Rule definition objectContains metadata about the rule, such as rule type■Rule data objectContains the expression to be evaluatedThe following table illustrates the objects created for a single admin role.ObjectTypeBaseObjectMember PolicyObjectsAdmin PolicyObjectsOwnerPolicyObjectsAdminRole1 Member rules: 2 (1rule definition objectAdmin rule: 2 (1 ruledefinition object andOwner rule:2 (1 ruleChapter 6: Optimizing Identity Manager 71