How to map Parameterized Role values in ResourceType directives for provisioning?

Products Identity Manager Discussions & Questions
,
1

Hi everyone,

I am setting up Parameterized Roles (assigning a role to a user with an associated Organization parameter) based on the documentation here: Configure a Parametrized Role | Netwrix Product Documentation

While configuring the role and assigning the parameter works as expected, I am struggling to find out how to use this parameter value during the provisioning step.

Specifically:

  1. How do I reference/access the role parameter’s value inside a ResourceType or Resource directive to map and push it to the target system?

  2. Is there a specific C#/LINQ expression syntax to navigate from the user/assignment (SingleRoleAssignment) to the parameter value?

  3. Where in the official documentation is this provisioning pattern covered?

Any code snippets or pointers to relevant documentation/examples would be greatly appreciated.

Thanks in advance for your help!

2

Hi Thierry,
Have you reviewed this page about ResourceTypes? It may help with questions 1 & 2.

3

Hello Thierry,

You for each Role with parameter value you need to map a scalar, query or navigation rule.

For example lets assume you have a role “Badge” with a parameter “Time Slot”.

The “Time Slot” has 3 possible values.

Each value will be represented by a dedicated rule.

image
image1902×315 29.7 KB

Regards

Hazem

4

Hello,

Thank you for the clarification. I understand that, with the current implementation, each possible parameter value has to be handled by a dedicated scalar, query, or navigation rule.

However, I believe this raises a significant limitation for the use of Parameterized Roles in real-world provisioning scenarios.

In our use case, the parameter represents an Organizational Unit, and we have approximately 100 possible values.

With the current approach, we would therefore have to create around 100 provisioning rules that are essentially identical, with the only difference being the parameter value they handle.

This seems to defeat one of the main benefits of having a parameterized role in the first place. The role assignment is dynamic and can carry a parameter value, but the provisioning logic cannot consume that value dynamically.

Feature request

Would it be possible to introduce a mechanism for Parameterized Rules, similar to Parameterized Roles?

Ideally, a ResourceType/Resource directive would be able to access the parameter value associated with the user’s SingleRoleAssignment, for example conceptually:

Parameterized Role
    Role: MyRole
    Parameter: Organization = "OU123"

        ↓

Provisioning Rule
    Organization = <parameter value>

The rule could then use the parameter value dynamically in its C#/LINQ expression instead of requiring one rule per possible value.

For example, instead of having:

Rule 1 → Organization = "OU001"
Rule 2 → Organization = "OU002"
Rule 3 → Organization = "OU003"
...
Rule 100 → Organization = "OU100"

we would have a single rule:

Rule → Organization = ParameterizedRole.ParameterValue

This would make Parameterized Roles much more scalable, especially when the parameter represents data such as an organizational unit, company, department, location, cost center, etc., where the list of possible values can be large or can change over time.

More generally, I think the underlying principle should be:

If a value can be dynamically associated with a role assignment through a Parameterized Role, that value should also be accessible to the provisioning engine so that it can be consumed dynamically by a ResourceType/Resource rule.

Could you please confirm whether this is something that could be considered as a product enhancement / feature request?

If there is already an existing feature request or roadmap item covering this capability, I would also be very interested in linking our use case to it.

Thank you.