(all)

The identity policy applies to all users.

where <user-filter>

The user must match one or more attribute values.

Users where title=manager and locality=east

in <org-rule>

The user must belong to named organizations.

Note: When you select this option, CA Identity Manager displays a new list box where you can select the following options:

• organization <organization> [and lower]-- Use an organization search screen to select an organization and, optionally, include the organization’s child organizations.
• Organizations where <org-filter> [and lower]--Specify a filter that selects one or more organizations.

Users in organization sales and lower

where <user-filter> and who are in <org-rule>

The user must match specific user attributes and belong to a specific organization.

title=manager and organization=Sales*

who are members of <group-member-rule>

The user must belong to a group which meets a condition specified by attributes on the group.

Note: When you select this option, CA Identity Manager displays a new list box where you can select the following options:

• group <group>--Use a group search screen to select a group.
• group where <group-filter>--Specify a filter that selects one or more groups.

Users who are members of groups where owner=CIO

who are members of <role-rule>

The user must be a member of a role. The role can be an:

• access role
• admin role
• provisioning role

  Note: To use provisioning roles, CA Identity Manager must integrate with a Provisioning Server. See the Installation Guide for more information.

Users who are members of the Help Desk role

who are administrators of <role-rule>

The user must an administrator for a role. The role can be an:

• access role
• admin role
• provisioning role

  Note: To use provisioning roles, CA Identity Manager must integrate with a Provisioning Server. See the Installation Guide for more information.

Users who are administrators of the Sales Manager role

who are owners of <role-rule>

The user must be an owner for a role. The role can be an:

• access role
• admin role
• provisioning role

  Note: To use provisioning roles, CA Identity Manager must integrate with a Provisioning Server. See the Installation Guide for more information.

Users who are owners of the User Manager role

returned by the query <LDAP-query>

The user must meet a condition based on an LDAP query.

User who meet the conditions of an LDAP query.

For example: (departmentNumber=Accounts)

in <administrative-union-constraint>

The user must meet at least one of the conditions in a list of conditions. You can include the following types of filters in an administrative union constraint:

• Member of access/admin/provisioning role
• Administrator of access/admin/provisioning role
• owner of access/admin/provisioning role
• member of a group

Users who are a member of the Certify Manager role, or who are an owner of the Certify Manager role.

in <administrative-intersection-constraint>

The user must all of the conditions in a list of conditions. You can include the following types of filters in an administrative union constraint:

• Member of access/admin/provisioning role
• Administrator of access/admin/provisioning role
• owner of access/admin/provisioning role
• member of a group

Users who are members of the Contract Initiator role and the Contract Approver role.