LB Group Entitlement deprecated in IDM 4.7.1

[dbuschke]

Hi,
I am wondering that the Loopback Group Entitlement package was deprecated in IDM 4.7.1. Designer says:

PCRS has been deprecated with the introduction of CPRS from IDM 4.7.1

It's understandable that PCRS gets deprecated but why is the whole Entitlement package deprecated? This means the Group Entitlement shouldn't been used anymore and I have to replace all the usages with... yeah with what?

regards
Daniel

[geoffc]

On 8/21/2018 8:54 AM, dbuschke wrote:
>
> Hi,
> I am wondering that the Loopback Group Entitlement package was
> deprecated in IDM 4.7.1. Designer says:
>
>>
>> PCRS has been deprecated with the introduction of CPRS from IDM 4.7.1
>>
>
> It's understandable that PCRS gets deprecated but why is the whole
> Entitlement package deprecated? This means the Group Entitlement
> shouldn't been used anymore and I have to replace all the usages with...
> yeah with what?

It is pretty easy to write your own IDV Group entitlement package. I
have one you can use if you would like.

[dbuschke]

geoffc;2486110 wrote:
On 8/21/2018 8:54 AM, dbuschke wrote:
> I am wondering that the Loopback Group Entitlement package was
> deprecated in IDM 4.7.1. Designer says:
>
>>
>> PCRS has been deprecated with the introduction of CPRS from IDM 4.7.1
>>
>


It is pretty easy to write your own IDV Group entitlement package. I
have one you can use if you would like.

I already thought about that. But I couldn't imagine that MF will remove a wonderful working feature and hoped that I missed something. Also we have to switch over all customers to a new driver which just generates some work without a real outcome.

Anyway, thank you for your offer. As you said that should be easy enough to implement and is a good issue to practice your entitlement skills. We will implment that by ourselves. Thanks.

regards
Daniel

[geoffc]

On 8/22/2018 3:24 AM, dbuschke wrote:
>
> geoffc;2486110 Wrote:
>> On 8/21/2018 8:54 AM, dbuschke wrote:
>>> I am wondering that the Loopback Group Entitlement package was
>>> deprecated in IDM 4.7.1. Designer says:
>>>
>>>>
>>>> PCRS has been deprecated with the introduction of CPRS from IDM 4.7.1
>>>>
>>>
>>
>>
>> It is pretty easy to write your own IDV Group entitlement package. I
>> have one you can use if you would like.
>
> I already thought about that. But I couldn't imagine that MF will remove
> a wonderful working feature and hoped that I missed something. Also we
> have to switch over all customers to a new driver which just generates
> some work without a real outcome.
>
> Anyway, thank you for your offer. As you said that should be easy enough
> to implement and is a good issue to practice your entitlement skills. We
> will implment that by ourselves. Thanks.

It really is straightforward, and a worthwhile task to try.

[tomerazran]

I ran into the same issue myself. I was also very surprised when discovered that the build-in Group entitlement was removed, without a good explanation about the replacement.

Can you please share your solution? How did you implemented the Group entitlement? Is it with the custom-entitlements package?

[dbuschke]

---

@tomerazran wrote:

Can you please share your solution? How did you implemented the Group entitlement? Is it with the custom-entitlements package?

---

 Yes, we created a custom Loopback package which uses Custom Entitlements package for EntitlementConfiguration creation. Also we added support for dynamic groups.

It's pretty easy and forward.

regards
Daniel

[geoffc]

What approach did you take for Dynamic Group support?  Now you have me curious how you handled it.

[dbuschke]

Hi,
you can set two different entitlement handling modes:

1. just add the user as a static member onto the dynamic group
2. add the group fqdn into a custom multi value attribute (onto the user) which should be used as filter by the dynamic group query

Your question made me curious. Any other ideas on handling dynamic groups?

regards
Daniel

[geoffc]

I figured you did the direct add to member list on dynamic groups.

I see what you did for the Dynamic group.  You defined a dynamic group that looks for its own name.

Then you stamp any members you want with that attribute.  Hmm, I feel like we have such an attribute called Group Membership already  🙂  Reiventing a square rule is pretty clever.

[dbuschke]

We use this feature to migrate customers which are using a ton of dynamic groups to roles/resources while this groups are already consumed by another ton of LDAP applications. And yes, that's an "edge case".

regards
Daniel