...
There are the following situations when the device should be recomputed:
| # | Change | Comment |
|---|---|---|
| 1 | Owner name or fullName is changed | |
| 2 | The link itself is changed | The roleMembershipRef value corresponding to the link is added or deleted. |
| 3 | User is added (including the link) | This is a special case of the above - a specific value of roleMembershipRef is added (along with the whole user object). |
| 4 | User is deleted (had the link before) | This can be understood (again) as a special case of the above - a specific value of roleMembershipRef is deleted (along with the whole user object). |
The situation #1 can be implemented using the following policy rule:
...
We have the following options: TODO TODO TODO
| assigned | Assigned object(s) matching given selector(s). | ||
| assignedMatchingPolicyConstraints | Assigned object(s) that were matched by the policy constraint(s); and are also matching given selector(s). | ||
| assignedOnPath | Assigned object(s) that are present on assignment path that leads to the particular policy rule; and are also matching given selector(s). | ||
| assignee | Assignee object(s) matching given selector(s). |
Recomputing user when device changes
...