Assign Resource within a time frame (staged on / off boarding)

Within academia we have a common use case where we need to assign or remove certain resources at a date that is not the identity start or end date. 

An example new student lifecycle could be:

1. Student is sent an offer - Identity is created with a start date and gets access to the enrolment system resources.
2. Student accepts the offer, and we assign the Active Directory, email, site access, and other resources on a particular date (usually the week before term starts), whilst removing access to the enrolment system.
3. Student completes their course, on their course end date we remove their site access, but their AD and email account remains so that they can access their exam results.
4. Student renews - back to step 2
5. Student ends, we remove all access after 12 months

So you can see at step 2 and 3 we have a requirement to add or remove resources based on a date that is not their start or end date.  Historically this use case has seen the need for plugins to action the change.  This can be achieved out of the box by assigning the required resources to a role and controlling the role assignment using conditional role policies.

It is also worth considering that whilst this use case is specifically around date based access, you could amend your role policy Lua script to take any condition into consideration.

Below is an example of how you might go about this: 

Create your resource as normal:

For this example we create a custom field ldapStartDate of the type date:

Then create a role for the resource and assign the resource to it:

Next create a Lua script that controls what conditions should be met to apply the role:

local LDAPStart = identity.form('ldapStartDate')

local myUser = identity.form('uniqueid')

log.debug("Evaluating LDAP role for: " .. myUser)

log.debug("LDAP start date is: " .. LDAPStart)

if string.len(LDAPStart) > 0 then

  local lvNow = os.time()

  local strYear = string.sub(LDAPStart, 1,4)

  local strMonth = string.sub(LDAPStart, 6,7)

  local strDay = string.sub(LDAPStart, 9,10)

  local LDAPDate = os.time{year=strYear, month=strMonth, day=strDay}

  if LDAPDate < lvNow then

    log.debug("Start date is in the past, applying role to " .. myUser)

    return true

  else

    log.debug("Start date is in the future, not applying role to " .. myUser)

    return false

  end

else

  log.debug(myUser .. " does not have an LDAP start date")

  return false

end

You could expand the Lua script out to evaluate end date conditions as well if you wanted.

Edit your Role and select Role Policy, populating the Lua Script field with your script:

Edit the categories that you’d like the resource to be applied to and add the role you created:

Finally we need to enable a scheduled evaluation of the role policy Lua script.  To do this add a line to a crontab file that calls the ProcessRolePolicies job

Here is an example that calls the evaluation every 15 minutes.  Depending on the load, amount of policies, and amount of identities, you will need to tailor this accordingly :

*/15 * * * * www-data cd /usr/share/ideiio/core/bin && /usr/bin/php cron.php ProcessRolePolicies >/dev/null 2>&1

Testing:

Create an identity using a category with the role assigned.  Be sure to populate the date field with a date in the future:

Note that when the user is created, the resource is not assigned:

Edit the start date field so that the value is in the past (the date was 21/01/2022 when captured):

When you click save, you will note that a provisioning task has been created:

And when checking the user’s access, the resource has been applied, showing that the access has been granted via our role:

When changing the start date to be in the future, the role, and therefore the resource is removed from the identity.