CA Identity Manager Implementation Guide - CA Technologies

Identity Policy OptimizationsIdentity Policy OptimizationsAn identity policy is a set of business changes that occurs when a user meets acertain condition or rule. These changes can include assigning or revoking roles,assigning or revoking group membership, and updating attributes in a userprofile.Identity Manager evaluates identity policies when user synchronization occurs.Identity policy performance is affected by the following:■■How the identity policies are configuredHow often user synchronization occursHow Users and Identity Policies Are SynchronizedWhen using identity policies, it is important to understand how CA IdentityManager evaluates and applies the policies to users. Without a thoroughunderstanding of the user synchronization process, you may configureidentity policy sets that yield unexpected results.The following procedure describes how CA Identity Manager evaluates andapplies identity policies:1. The user synchronization process begins:■■Automatically—You can configure CA Identity Managertasks toautomatically trigger user synchronizationManually—Use the Synchronize User task in the User Console tosynchronize a user.2. CA Identity Manager determines the set of identity policies that apply to auser.3. CA Identity Manager compares the set of identity policies that apply to a userwith the list of policies that have already been applied to that user.Note: The list of policies that have been applied to a user is stored in the%IDENTITY_POLICY% well-known attribute in the user profile. Forinformation on configuring this attribute, see the Configuration Guide.■■If an identity policy is on the list of applicable policies, and the policy hasnot been applied to the user previously, then CA Identity Manager addsthe policy to an allocation list.If an identity policy is on the list of applicable policies, the policy hasbeen previously applied to the user, and the Apply Once setting for thepolicy is disabled, CA Identity Manager adds the policy to a reallocationlist.Chapter 6: Optimizing Identity Manager 85