Dynamic Admin Role Problems - IDM7.1

Question

Hi Everyone. I'm having problems getting a dynamic admin role to work correctly. No matter what I do I always get the error at logon that the user controls no organizations and has no capabilities. Here is how the admin role is configured.
General:
Type = Identity Objects
Assigners = blank (I have also tried configurator)
Organizations = Top
Scope of Control:
Controlled Organizations = Top
None for everything else.
Capabilities:
All caps assigned, no cap rule.
Assign to users:
Has the rule below assigned to it. If I check a user that is in the AD group mentioned in the rule, it gives me a '1', if I check one that doesn't have the group, a '0'
Rule:
<?xml version='1.0' encoding='UTF-8'?>
<!DOCTYPE Rule PUBLIC 'waveset.dtd' 'waveset.dtd'>
<!--  MemberObjectGroups="#ID#Top" authType="UserIsAssignedAdminRoleRule" id="#ID#Rule:IAM Admin Admin Role Rule" lastMod="26" lastModifier="Configurator" name="IAM Admin Admin Role Rule"-->
<Rule authType='UserIsAssignedAdminRoleRule' id='#ID#Rule:IAM Admin Admin Role Rule' name='IAM Admin Admin Role Rule' createDate='1239044336520' lastModifier='Configurator' lastModDate='1248287397906' lastMod='26'>
  <RuleArgument name='context'/>
  <RuleArgument name='runAsUser'/>
  <isTrue>
    <contains>
      <rule name='my_rulelibrary:get_DownCaseList'>
        <argument name='dnlist' value='$(runAsUser.accounts[AD].groups)'/>
      </rule>
      <downcase>
        <rule name='my_Configuration:IAM Admin Group Name'/>
      </downcase>
    </contains>
  </isTrue>
  <MemberObjectGroups>
    <ObjectRef type='ObjectGroup' id='#ID#Top' name='Top'/>
  </MemberObjectGroups>
</Rule>I have also added the item below to the system configuration and reset the app server
<Attribute name='authz'>
            <Object>
              <Attribute name='checkDynamicallyAssignedAdminRolesAtLoginTo'>
                <Object>
                  <Attribute name='Administrator Interface'>
                    <Boolean>true</Boolean>
                  </Attribute>
                  <Attribute name='Service Provider User Interface'>
                    <Boolean>false</Boolean>
                  </Attribute>
                  <Attribute name='User Interface'>
                    <Boolean>true</Boolean>
                  </Attribute>
                </Object>
              </Attribute>
            </Object>
          </Attribute>Any ideas?

Answer 1

Hi,
the view handed to these kind of rules is created with the noFetch option set to true. As a result the AD groups of the user are not available during rule evaluation.
You could solve your task by doing a search using the FormUtil class.
I would however advise you to only do this in a small or demo environment as the usage of usermember rules does not scale at all. This is a pure sales feature that will quickly bring down a production environment with high CPU utilization and horrible response times. Unlike what one might guess these rules are not only evaluated during login but almost all the time, often multiple times for each click. Even if the rule as such only performs cheap operations the AuthCache class hogs more and more CPU time with each rule of this kind you add to the system.
Regards,
Patrick